gemeinviloging[.]webflow[.]io

This domain, gemeinviloging.webflow.io, is actively impersonating Gemini as part of a credential phishing campaign. Registered on June 30, 2026, through Webflow, the site resolves to 172.64.151.8 (AS13335, Cloudflare, Inc.) and presents a page titled 'Gemini Login - Your Gateway to Secure Digital Asset Management.' The domain is hosted on Webflow infrastructure and protected by Cloudflare, with HTTP/3 support detected. Analysis indicates the site is designed to harvest login credentials, as confirmed by its classification as a credential phishing threat targeting Gemini users. Infrastructure review reveals the domain lacks assigned nameservers (NS_NOT_FOUND) but maintains an active SSL certificate issued by Google Trust Services (WE1). The site returns an HTTP 200 status, confirming its operational status as of July 12, 2026. Security vendors have flagged the domain, with 16 of 91 engines on VirusTotal identifying it as malicious, and it appears on at least one blocklist. Defenders should treat this domain as high-risk due to its active status, confirmed brand impersonation, and credential theft intent. No evidence suggests the site has been taken down or mitigated. Organizations should block resolution to 172.64.151.8 and monitor for related subdomains or newly registered Webflow-hosted domains with similar naming patterns. The use of Cloudflare may complicate takedown efforts, requiring coordination with the hosting provider and certificate authority. Further analysis of the site's content is recommended to identify additional indicators of compromise, though no visual or structural details are currently available for review.