gemini-logiu[.]webflow[.]io

Analysis of gemini-logiu.webflow.io performed on 21 July 2026 shows the site is hosted on the IP address 172.64.151.8, which belongs to the Webflow hosting platform. The domain was registered through Webflow, Inc., and the authoritative nameserver information is not publicly available (NS_NOT_FOUND). VirusTotal has recorded detections from 14 of 95 scanned security vendors, indicating a moderate consensus that the content is malicious. The site is currently listed on at least one public phishing blocklist and has been actively blocked by the PhishDestroy filtering service, confirming that defensive feeds consider it a threat. The domain remains reachable, and its status is reported as active. The available intelligence does not contain a page title, SSL certificate details, or explicit references to a target brand, so the precise phishing lure cannot be confirmed. Likewise, no Open Threat Exchange (OTX) or additional intelligence sources have been linked to the domain, leaving the exact victim profile uncertain. The presence of multiple vendor detections and blocklist entries, combined with the active hosting on a shared Webflow infrastructure, suggests that the site is being used for credential‑harvesting or other fraudulent activities typical of generic phishing campaigns. Defenders should continue to block traffic to gemini-logiu.webflow.io at network perimeters and proxy layers, update URL filtering and threat‑intelligence feeds with the domain and its IP address, and monitor for any emerging associations with credential‑stealing kits. Because the domain leverages a legitimate hosting provider, additional scrutiny of outbound connections from affected users may be required to detect potential data exfiltration. Ongoing observation of the domain’s DNS records and any changes to its hosting configuration is recommended, as alterations could signal a shift in the underlying threat actor’s tactics.