geminylwoin[.]webflow[.]io

Analysis indicates geminylwoin.webflow.io is a high-risk brand impersonation domain targeting Gemini, currently in an offline state. The page title 'Transparent Cryptocurrency Transactions Enabled by Gemini Login' indicates a credential-harvesting narrative designed to simulate legitimate authentication flows and encourage user login interaction under a fraudulent context.

Technical indicators confirm malicious classification signals: VirusTotal reports 17/95 security vendors flagging the domain, it appears on 1 security blocklist, and is actively blocked by PhishDestroy. The domain resolves to IP 104.18.36.248 located in the US under AS13335 Cloudflare, Inc. Google Safe Browsing explicitly flags the domain as phishing. The registrar is Webflow. SSL certificate is issued by Google Trust Services / WE1. No domain creation date is provided in the dataset. These combined signals indicate a hosted phishing infrastructure leveraging reputable CDN and SSL services to mask malicious intent while maintaining TLS legitimacy.

Current status shows the domain is taken offline, reducing active exposure but not eliminating residual risk due to potential redeployment or reuse of the same infrastructure patterns. Recommended mitigations include enforcing network-level blocking of the domain and IP 104.18.36.248, monitoring authentication logs for any attempted Gemini credential submissions, and correlating activity with similar Webflow-hosted impersonation domains. Given confirmed phishing classification by multiple vendors and Safe Browsing, any user interaction should be treated as compromised, and credential resets should be enforced where exposure is suspected. Continuous threat hunting for related infrastructure using similar naming patterns is advised.