gezimnilogn[.]webflow[.]io

The domain gezimnilogn.webflow.io was registered on March 12, 2026 through Webflow and is currently taken offline. Analysis shows the site served a page titled "Gemini $Login", indicating a targeted impersonation of the Gemini brand for a crypto scam. The site was secured with an SSL certificate issued by Google Trust Services under the WE1 identifier, and it responded with an HTTP 404 status, suggesting the malicious content may have been removed or deliberately hidden. Infrastructure analysis reveals that the domain resolves to IP address 104.18.36.248, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States.

Detected technologies include Webflow, Cloudflare, and HTTP/3, consistent with the registration method. Threat intelligence indicates that 2 of 94 security vendors on VirusTotal flagged the domain, and it appears on three public blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, further confirming its malicious intent. The combination of a brand‑specific page title, a crypto‑related scam classification, and the presence on multiple blocklists points to a credential‑harvesting or fund‑extraction campaign targeting Gemini users.

Defenders should add gezimnilogn.webflow.io to URL filtering policies, enforce blocklist entries, and monitor for other Webflow‑hosted domains that reference Gemini or similar financial services. Continuous observation of Cloudflare‑hosted IP ranges for newly created Webflow subdomains is recommended, as the rapid provisioning capabilities of the platform can be abused for short‑lived impersonation sites. Incident response teams should also review any authentication attempts to Gemini services that coincide with the domain's active period and consider user awareness messaging about unsolicited login prompts referencing Gemini.