https://gmail-secure-login.onlineformlogin.site/

Impersonating Gmail

Intent: Data collection

• Domain name closely resembles Gmail's real domain
• Domain was registered very recently
• DNS nameservers do not match Gmail's known infrastructure
• Domain not registered through Gmail's usual registrar
• TLS certificate was issued very recently

Minimal text 'Gmail - Connected (encrypted)' with no visible input fields or clear user action