geimiunisweslogini[.]webflow[.]io

PhishDestroy has identified a high-risk phishing domain, geimiunisweslogini.webflow.io, which is impersonating the Gemini cryptocurrency exchange. This specific threat involves a fake login page designed to steal user credentials through a carefully crafted brand impersonation attack. The domain was registered through Webflow and was actively serving a fraudulent Gemini login interface at the time of analysis.

Technical indicators for this domain are severe. VirusTotal data shows that 13 out of 95 security vendors flagged the domain as malicious, and Google Safe Browsing specifically labels it as a phishing site. The domain resolves to IP address 172.64.151.8, and it appears on three security blocklists. The SSL certificate is issued by Google Trust Services (WE1), which adds a false sense of legitimacy. The page title was explicitly set to 'Gemini login' to deceive visitors. The domain is currently offline, but its registration through Webflow and the use of a trusted certificate issuer highlight the sophistication of the attack.

To protect against such brand impersonation phishing, users should always verify the URL before entering credentials, looking for subtle misspellings or unusual subdomains like 'geimiunisweslogini'. Enable two-factor authentication on all accounts, use a password manager that auto-fills only on legitimate domains, and report any suspicious login pages to the impersonated brand. PhishDestroy recommends checking the full report for additional indicators and staying vigilant against similar threats.