gemuniloogin[.]webflow[.]io

Analysis as of July 23, 2026 indicates that the subdomain gemuniloogin.webflow.io is being used to impersonate the cryptocurrency exchange Gemini. The site returns an HTTP 404 status, which suggests the landing page has been removed or taken offline, consistent with the “offline” status reported. Despite the lack of visible content, the domain was flagged by 12 out of 95 security vendors on VirusTotal, providing moderate confidence that it has been associated with malicious activity. The page title observed during prior scans – “Gemini Login - Trading Exchange Platform” – directly references Gemini and aligns with the credential‑phishing classification recorded in the intelligence. Infrastructure analysis shows the domain resolves to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335) in the United States.

Cloudflare services are confirmed by the presence of Cloudflare‑owned nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the site served HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 identifier, a common certificate for Cloudflare‑proxied sites, and does not provide any brand‑specific validation. Registration data indicates the domain was created on May 08, 2013 and is currently registered through MarkMonitor, Inc., a registrar frequently used by legitimate enterprises, which may be an attempt to lend credibility. The domain appears on a single public blocklist, specifically PhishDestroy, reinforcing the phishing attribution.

No additional public blocklists or Safe Browsing entries are listed, and the absence of further detections limits the scope of current intelligence. Defenders should continue to monitor the domain for any re‑activation, add the host to internal blocklists, and enforce credential‑filtering rules that detect attempts to submit Gemini‑related login data to unknown endpoints.