mass.report
Scan Intelligence Report0/100
high Risk
gconnect4.com
https://gconnect4.com/c7608cb374be73cd217a423ff4576b8f
IP
172.67.184.164 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
0 days ⚠
HTTP
200 · 18.4s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Gmail (Google) impersonation on gconnect4.com
Vendors
28/31
Status
partial
✓ polyswarm✓ yandex✗ norton✓ microsoft✗ brightcloud✓ avast✓ avg✓ chainpatrol✓ spamhaus✓ apple✓ sophos✓ emsisoft✓ netcraft✓ apwg✓ urlquery✓ isitphish✓ phishreport✓ kaspersky✓ urlscan✓ cisa✓ openphish✓ phishtank✓ eset✓ virustotal✓ drweb✓ urlabuse✓ bitdefender✗ threatyeti✓ mcafee✓ google✓ fortiguard
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Gmail (Google) impersonation on gconnect4.com
Credential PhishingTechnology · 7/19/2026
Summary
The page presents a Gmail sign-in UI with Google branding (Google logo, Gmail title, and UI text) loaded from a domain (gconnect4.com) that is not an official Google domain. The HTML source shows a Gmail login shell with an email/phone field and a Next button, and a Google logo is loaded from the site. The visible branding and structure strongly indicate impersonation of Google/Gmail. However, the final URL is not Google's domain, and the page includes garbled hosting signals (new domain, Cloudflare, external scripts) that support a phishing clone rather than a first-party Google page.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://gconnect4.com/cdn-cgi/rum?, https://gconnect4.com/api/access-keys/validate, https://gconnect4.com/gql.
▸Distinctive asset clues: webpack-cd21314525c0420e.js, 613-3760b5813b376f85.js, 26456b22f0f01e36.css, google-logo.svg.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 33
Hosts: 3
Domains: 3
Suspicious Endpoints
hxxps://gconnect4[.]com/api/access-keys/validate
hxxps://gconnect4[.]com/c7608cb374be73cd217a423ff4576b8f/
Attack Techniques (5)
Impersonation of a well-known brand (Google/Gmail) in page title, UI, and brandingHosted on a non-official domain with Google branding to harvest credentialsSPA-like structure with dynamic JavaScript assets and login shell renderingUse of external scripts and image assets to mimic legitimate Google UISSL issued very recently on a new domain (potentially evading some suspicion)
Indicators of Compromise (6)
▸Page title 'Gmail' and visible Google logo on a non-Google domain
▸Branding matches Gmail login UI (Sign in to continue to Gmail) but domain is gconnect4.com
▸POST requests to /api/access-keys/validate and /gql, suggesting credential or session-related calls
▸Google logo served from the page (google-logo.svg) while hosting on gconnect4.com
▸New domain age (0 days) with Cloudflare in front
▸SSL certificate issued recently (valid from Jul 7 2026) with Google Trust Services issuer (WE1) but for gconnect4.com
Risk AssessmentUsed in abuse reports
The scan indicates a strong impersonation attempt: Gmail branding is presented on a non-Google domain gconnect4.com, with a sign-in UI designed to resemble Google's Gmail login. The dedicated login shell, presence of a Google logo, and credential-related network calls (api/access-keys/validate, gql, hubs/session/negotiate) strongly suggest credential harvesting. The domain is very new (0 days) and protected behind Cloudflare, which is common in phishing setups to evade detection. Recommend treating as high-risk phishing impersonation and take action accordingly.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API