gemini-logine[.]webflow[.]io

Analysis of gemini-logine.webflow.io, observed on July 24, 2026, indicates that the domain is being used for brand impersonation targeting Gemini. The site is registered through MarkMonitor, Inc., a registrar commonly employed for legitimate brand assets, and the domain was originally created on May 08, 2013. Infrastructure inspection shows that the domain resolves to the IPv6 address 2606:4700:440c::ac40:9708, which belongs to AS13335 Cloudflare, Inc., confirming that the hosting is provided by Cloudflare. The presence of Cloudflare’s HTTP/3 support and the SSL certificate issued by Google Trust Services (WE1) further corroborate the use of reputable services to lend credibility to the malicious page.

Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that nine of ninety‑five security vendors have identified the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. The HTTP response currently returns a 404 status with the page title “404 - Page not found,” indicating that the phishing payload may have been removed or taken offline. Nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com are consistent with the Cloudflare hosting environment.

The known intelligence classifies the activity as credential phishing, specifically aimed at harvesting Gemini user credentials. While the page content is not publicly available, the combination of brand impersonation, social‑engineering warnings, and vendor detections provides sufficient evidence to treat the domain as a high‑confidence phishing indicator. Defenders should block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any related traffic to the associated Cloudflare IP range.