geminzilogin[.]webflow[.]io

The domain geminzilogin.webflow.io is currently flagged as a credential‑phishing site. VirusTotal analysis shows that 13 of 91 security vendors have classified the domain as malicious, indicating a non‑trivial level of detection across independent scanning engines. The domain appears on a single public blocklist, confirming that at least one external filtering service has identified it as abusive. Registration information reveals that the domain was created through the Webflow platform, a legitimate website‑building service that is sometimes leveraged by threat actors to host deceptive pages.

PhishDestroy, a dedicated anti‑phishing feed, has also listed the domain as blocked, providing additional corroboration of its malicious intent. No public data is available regarding the underlying IP address, hosting ASN, geographic location, SSL certificate details, HTTP response codes, or page title, leaving those infrastructure elements unverified at this time. Consequently, the exact hosting infrastructure and any potential content delivery mechanisms remain uncertain.

Defenders should treat the domain as high‑risk and enforce immediate blocking at DNS resolvers, proxy filters, and endpoint web controls. Continuous monitoring of DNS queries for the domain is advised, as well as inclusion in threat‑intelligence feeds that ingest blocklist and VirusTotal data. Organizations employing Webflow‑based allowlists should review and potentially tighten policies to prevent abuse of the platform for credential‑phishing campaigns.