geminilluginu[.]webflow[.]io

This domain presents an elevated risk as a brand impersonation phishing site specifically targeting Gemini cryptocurrency exchange users. PhishDestroy confirms that geminilluginu.webflow.io is designed to steal login credentials by mimicking the official Gemini login page. The site was taken offline after being flagged, but users should remain vigilant as similar threats may reappear.

Technical indicators paint a clear picture of malicious intent. The domain was created on February 21, 2026, through NameCheap, Inc., and resolves to IP 172.64.151.8. VirusTotal shows 18 out of 95 security vendors flagging this domain as malicious, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which can lend a false sense of legitimacy. The page title "Gemini Login | Secure Access to Your Cryptocurrency Exchange Account" is a direct copy of the official Gemini login page, designed to trick users into entering their credentials.

To protect against such phishing attacks, Gemini users should always verify the URL before logging in, ensuring it is the official gemini.com domain. Enable two-factor authentication (2FA) on your Gemini account to add an extra layer of security. If you entered credentials on this phishing site, change your Gemini password immediately and contact Gemini support. Monitor your account for unauthorized activity and consider using a password manager to detect lookalike domains.