giminiglogin[.]webflow[.]io

The domain giminiglogin.webflow.io has been identified as a brand impersonation threat specifically targeting Gemini, a legitimate cryptocurrency exchange. This site is currently offline, having been taken down after its malicious activity was detected. It posed as a Gemini login page, likely aiming to steal credentials or drain cryptocurrency wallets from unsuspecting users.

Technical analysis reveals that this domain was flagged by 15 out of 95 VirusTotal security vendors, indicating broad consensus on its malicious nature. It also appears on two security blocklists and is marked as phishing by Google Safe Browsing. The domain was registered through MarkMonitor, Inc. and created on May 08, 2013, though its malicious use appears recent. It resolves to IP address 104.18.36.248 and uses an SSL certificate from Google Trust Services (WE1), which may lend a false sense of legitimacy.

Given the high risk level and confirmed brand impersonation targeting Gemini, users should avoid any interaction with this domain or similar variations. As the site is now offline, the immediate threat is mitigated, but vigilance is advised for future phishing attempts. PhishDestroy recommends enabling two-factor authentication on all cryptocurrency accounts and verifying URLs before entering sensitive information.