gemanelogin[.]webflow[.]io

The domain gemanelogin.webflow.io has been identified as a brand impersonation threat specifically targeting Gemini, a well-known cryptocurrency exchange. This site is currently offline, having been taken down after its malicious intent was confirmed. The page title, 'Gemini $Login - Your Gateway to Secure Digital Asset Management,' was designed to deceive users into believing they were accessing a legitimate Gemini login portal.

Technical analysis reveals several concerning indicators. The domain was flagged by 12 out of 95 security vendors on VirusTotal, indicating a consensus among security tools about its malicious nature. It is registered through MarkMonitor, Inc. and resolves to IP address 172.64.151.8. The domain was created on May 08, 2013, which is unusually old for a phishing site, possibly indicating a compromised or repurposed domain. Additionally, it appears on 1 security blocklist and has an SSL certificate from Google Trust Services, which may lend a false sense of legitimacy to unsuspecting visitors.

Given that the site is already offline, the immediate risk is mitigated, but users should remain vigilant. PhishDestroy recommends that anyone who may have visited this site or entered credentials should change their Gemini passwords immediately and enable two-factor authentication. Always verify URLs carefully before entering sensitive information, and report any suspicious domains to the brand being impersonated. Use reputable security tools to check links before clicking, and consider using a password manager to avoid manual entry on fraudulent sites.