gheimhienilogin[.]webflow[.]io

The domain gheimhienilogin.webflow.io is currently flagged as an active credential phishing site specifically impersonating Gemini, a cryptocurrency trading and exchange platform. Analysis confirms the domain is designed to harvest user credentials through deceptive login interfaces, presenting itself as a legitimate Gemini portal with modified characters in the page title to evade detection. Infrastructure analysis reveals the domain is registered through Webflow and resolves to the IP address 172.64.151.8. Security vendor assessments on VirusTotal indicate 17 of 95 engines have flagged this domain as malicious, reflecting moderate-to-high detection confidence. The page title, 'Ge𝓂ìni Løgin - Secuře | Trađinğ | Exchange,' employs Unicode character substitution to mimic the authentic Gemini branding while attempting to bypass basic security filters. No historical registration data or creation date is publicly available, suggesting potential obfuscation of domain provenance. Current status remains active, with no evidence of takedown or mitigation at the time of assessment. Organizations and users are advised to block the domain and associated IP address at the network perimeter. Endpoint protection systems should be updated to include this domain in phishing and credential theft signatures. Users who may have interacted with this domain should immediately reset credentials on the legitimate Gemini platform and enable multi-factor authentication. Security teams are encouraged to monitor for outbound connections to 172.64.151.8 and review logs for any prior engagement with gheimhienilogin.webflow.io.