gemniloogen[.]webflow[.]io

This domain, gemniloogen.webflow.io, poses a specific threat as a generic phishing site. It attempts to impersonate a legitimate trading platform, likely aiming to steal user credentials and sensitive information. The domain's page title, 'Ge𝓂ìni Løgin - Secuře | Trađinğ Platform,' is a clear indicator of its intent to deceive users into believing they are accessing a secure Gemini login page.

Analysis indicates that this domain was created on May 08, 2013, and is currently registered through MarkMonitor, Inc. Despite its age, the domain has been flagged by 15 out of 95 security vendors on VirusTotal, suggesting ongoing concerns about its legitimacy. The domain appears on one security blocklist and has been taken offline, implying that it was identified and mitigated as a threat. The SSL certificate is issued by Google Trust Services, which may have been used to enhance the appearance of legitimacy. The domain resolves to the IP address 172.64.151.8, which could be part of a larger infrastructure used for phishing attacks.

If users have visited gemniloogen.webflow.io, they should immediately check their account activity on Gemini and other financial platforms for any unauthorized transactions. It is recommended to change passwords and enable multi-factor authentication (MFA) on affected accounts. Users should also monitor their financial statements and credit reports for any signs of fraud. Reporting the incident to the relevant financial institution and to the domain registrar can help in further investigation and prevention of similar attacks.