geminiloginm[.]webflow[.]io

The domain geminiloginm.webflow.io is currently active and hosts a page titled “Gemini Login | Log in to Account”. Analysis shows the site is hosted on Webflow and fronted by Cloudflare (ASN13335) with the IP address 172.64.151.8 located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 name, indicating a valid HTTPS connection. The page is categorized as credential phishing targeting the Gemini brand. VirusTotal scans have flagged the domain by 14 of 91 security vendors, and Gridinsoft assigns a trust score of 0 out of 100. The domain is listed on at least one public blocklist and has been blocked by PhishDestroy. Technologies detected include Webflow, Cloudflare, and HTTP/3. No additional infrastructure details such as nameservers are available. The presence of a valid Cloudflare front‑end and a Webflow‑generated site suggests the actors leveraged a legitimate SaaS platform to host the phishing page, reducing the cost of infrastructure and increasing uptime. Defenders should add geminiloginm.webflow.io to domain block lists, monitor for similar Webflow‑hosted domains that reference Gemini, and enforce multi‑factor authentication for Gemini accounts. Users should be warned that any login request originating from this domain is unauthentic and must be ignored.