Security Report: webproxy.goku8.workers.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/6258ab48-ea6f-4224-b3c0-5f4eb9e813ff Domain and IP registration (RDAP)/api/v1/rdap/6258ab48-ea6f-4224-b3c0-5f4eb9e813ffHow often this domain was scanned/api/v1/domain/stats/webproxy.goku8.workers.dev Scan history for this domain/api/v1/domain/history/webproxy.goku8.workers.dev?limit=15

This website contacted 36 IPs in 4 countries across 21 domains to perform 99 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://webproxy.goku8.workers.dev/http:/www.wellsfargo.com/investing-wealth/

AI Security Verdict

Moderate Risk

Confidence: 62%

Risk Score

Genuine Wells Fargo investing content served through a third-party URL proxy on an unknown-age workers.dev host. No credential or payment forms and no threat-intel hits, but brand on a mismatched proxy domain warrants caution.

Risk Factors (4)

Third-party URL-proxy host renders another organisation's branded site on a mismatched domain

Hostname is on a free instant-publishing platform namespace (workers.dev) with no verified age or ownership

Page shows a form input placeholder pointing at https://example.com, indicating an unfinished or generic proxy wrapper

Proxy services can be used to bypass network filtering and to stage branded content away from the official domain

Safety Factors (4)

No credential, password or payment fields present in the captured DOM

No Indicators of Compromise, hunting rule malware patterns or known-kit matches

Page content mirrors the legitimate Wells Fargo site and links to official Wells Fargo domains such as connect.secure.wellsfargo.com

No cross-origin credential exfiltration or suspicious JavaScript behaviour detected

Domain age information unavailable

Details

Page Title

Investing and Wealth Management Services | Wells Fargo

Scan Type

public

Favicon Hash

MMH3: -1295626283

MD5: fe65b7c8154cfb13ff399dddbc6ff1ec

Domain Name Analysis

The domain name 'webproxy.goku8.workers.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'webproxy.goku8'. Count 7 characters in 'workers' with two vowels and five consonants. Splitting it apart reveals 1 word: workers. No strong language cues emerged from the frequency lists.

Screenshot

istomer service and FAQs Popular FAQs * How can I start working with a Financial Advisor? + What types of accounts does WellsTrade support + What are the WellsTrade account fees and commissions? ©...

Page Load Overview

1.41s

Total Load Time

1.4 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:10,992 chars

Detector Agreement:100%

Website Classification

Primary Category

finance banking52% confidence

Type: spa

Method: ml+structural+ocr_tiebreaker

All Detected Categories

finance banking

52%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
29	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	23.32.242.175Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS16625Akamai Technologies, Inc.
2	23.50.131.146Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
2	104.18.32.137Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	23.50.131.142Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
2	54.192.35.97Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
2	172.64.155.231Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	34.202.158.248Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
2	63.140.62.172Aws · CLOUD	United States	AS16509Amazon.com, Inc.
2	54.229.115.211Aws · CLOUD	Dublin, Leinster, Ireland	AS16509Amazon.com, Inc.
99	36	-	-