geminiinfologin[.]webflow[.]io

Analysis of the domain geminiinfologin.webflow.io shows that it was registered on 21 February 2026 through NameCheap, Inc. The domain resolves to the IP address 172.64.151.8, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating that the site used Cloudflare’s CDN and SSL termination. An HTTP request returns a 404 status code, and the page title extracted from the site reads "Geḿini Login – Sign to Geḿini account | Gemini Login", explicitly referencing the Gemini brand and suggesting a credential‑harvesting intent. The site is classified as a crypto‑related scam and is listed as an impersonation of Gemini.

VirusTotal has recorded 16 detections out of 95 scanners, and the domain is currently blocked by the PhishDestroy blocklist as well as one additional security blocklist. Automated fingerprinting identified the use of Cloudflare services and HTTP/3 protocol. The domain is presently offline, which limits real‑time observation, but historical data indicate the typical pattern of brand‑targeted credential‑collection campaigns hosted on free‑form webflow.io subdomains. Because the site is already flagged by multiple security vendors and appears on blocklists, defenders should ensure that network perimeter controls deny outbound connections to the resolved IP 172.64.151.8 and that DNS filtering policies include the full hostname.

Email security gateways should be tuned to detect messages that reference "Gemini Login" or contain similar Unicode‑obfuscated strings. Continuous monitoring of Cloudflare‑hosted subdomains for the Gemini brand is advised, as the attacker may reuse the infrastructure for new phishing pages. Organizations using Gemini services should advise users to verify URLs and to avoid entering credentials on any domain other than the official Gemini domain.