0/100

high Risk

gconnectapis.com

https://gconnectapis.com/66ef7e0a55d9f69e0743eabe8150ed3f/

172.67.164.154 · Cloudflare, Inc.

Location

Toronto, Canada

Domain Age

1 day ⚠

HTTP

200 · 18.4s

SSL

Valid· WE1, Google Trust Services, US

Status

COMPLETED

Visual Evidence

Zoom

Title: "Gmail"

Save

Linked Phishing Report

This scan is attached to a vendor submission report

Brand

Gmail (Google)

Vendors

28/31

Status

partial

✓ bitdefender✓ avast✓ chainpatrol✓ polyswarm✗ threatyeti✗ norton✓ yandex✓ sophos✓ avg✓ drweb✗ brightcloud✓ apwg✓ urlquery✓ spamhaus✓ apple✓ netcraft✓ urlscan✓ virustotal✓ eset✓ microsoft✓ cisa✓ isitphish✓ phishtank✓ phishreport✓ openphish✓ mcafee✓ kaspersky✓ google✓ emsisoft✓ urlabuse✓ fortiguard

KB/IOK Matches (0)—

No KB/IOK detections were recorded for this scan.

Gmail (Google)

Credential Phishing

Technology · 7/19/2026

Summary

The page displays a Gmail sign-in UI and branding (Google logo, Gmail typography) on the domain gconnectapis.com. The page title is Gmail and the static HTML shows a Google logo and a sign-in form UI, but the host is not google.com. Network requests and assets reference Google-like resources (google-logo.svg, Gmail sign-in UI) suggesting impersonation of Google's Gmail service. POST endpoints such as /api/access-keys/validate and /gql indicate credential-related interactions, though the form in static HTML does not include an actual login field; the UI strongly mirrors Google's login flow, and the domain age is extremely young, increasing impersonation risk.

Evidence Summary

▸Observed 3 capture stage(s); canonical stage is late_render_3s.

▸POST targets observed during capture: https://gconnectapis.com/cdn-cgi/rum?, https://gconnectapis.com/api/access-keys/validate, https://gconnectapis.com/gql.

▸Distinctive asset clues: webpack-cd21314525c0420e.js, main-f4701d23e362eb77.js, 10fa3f977975229d.css, google-logo.svg.

Capture

Stages: 3

Canonical: Late Render (+3s)

Changed: No

Credential Signals

Forms: 1

Password fields: 0

Late-stage login UI: No

Resource Signals

Resources: 33

Hosts: 3

Domains: 3

Suspicious Endpoints

hxxps://gconnectapis[.]com/api/access-keys/validate

hxxps://gconnectapis[.]com/66ef7e0a55d9f69e0743eabe8150ed3f/

Attack Techniques (3)

Brand impersonation via UI cloning (Gmail sign-in look-alike on non-official domain).Credential harvesting setup signals (auth-related endpoints present, including /api/access-keys/validate, /gql).Use of official-looking assets (google-logo.svg) and page title Gmail to mislead victims.

Indicators of Compromise (8)

▸Domain: gconnectapis.com does not belong to Google.

▸Page title: Gmail; visible UI mirrors Google sign-in.

▸External asset: google-logo.svg used in branding.

▸POST endpoints: /api/access-keys/validate, /gql, /hubs/session/negotiate?negotiateVersion=1 suggesting API-based auth surfaces.

▸SSL cert issued 1 day ago to gconnectapis.com (new domain).

▸WHOIS: domain created 2026-06-29, 1 day old.

▸IP resolution shows Cloudflare fronting the domain.

▸Page includes a Google-like sign-in UI but hosted on a non-Google domain.

Risk AssessmentUsed in abuse reports

The page presents a high risk impersonation of Google's Gmail login on a brand-new domain (1 day old) with a Google-signed SSL certificate and Google branding. The UI explicitly imitates Google’s sign-in flow (Gmail title, Google logo, 'Sign in' header, 'Next' button) on gconnectapis.com, a domain not owned by Google. The presence of credential-related endpoints and the overall setup strongly indicate credential phishing intent. Scanner-block considerations are not explicitly shown; however, the combination of impersonation signals and new-domain indicators warrants action. Recommend blocking or suspending domain access to mitigate user credential risk.

Recommended Action

Suspend Domain

Cross-Reference9

URL Intelligence