Security Report: webproxy.goku8.workers.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/66a631d0-16c9-4783-b8f4-7f4742e07bb6 Domain and IP registration (RDAP)/api/v1/rdap/66a631d0-16c9-4783-b8f4-7f4742e07bb6How often this domain was scanned/api/v1/domain/stats/webproxy.goku8.workers.dev Scan history for this domain/api/v1/domain/history/webproxy.goku8.workers.dev?limit=15

This website contacted 25 IPs in 4 countries across 18 domains to perform 59 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://webproxy.goku8.workers.dev/http://www.wellsfargo.com/help/online-banking/zelle-faqs/

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

A workers.dev proxy reproduces Wells Fargo's Zelle FAQ page under a non-Wells Fargo host with the bank's favicon, and Google Safe Browsing flags the page twice for social engineering. Brand impersonation, do not use.

Risk Factors (5)

Safe Browsing Social Engineering detections (2 instances) on a page impersonating a bank brand

Wells Fargo favicon served from a non-Wells Fargo host (verified favicon brand impersonation)

Free-instant workers.dev subdomain acting as a proxy/relay for the Wells Fargo URL, so the real bank domain appears in the address bar path

Excessive redirect chain (8 hops, 5 cross-domain) through advertising and tracking infrastructure

Unranked host with a very low legitimacy score (8/100)

Domain age information unavailable

Details

Page Title

Send and Receive Money with Zelle – Frequently Asked Questions

Scan Type

public

Favicon Hash

MMH3: 1828061046

MD5: cd112f1acb59ef6e59e09c0effd8ce2a

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'webproxy.goku8.workers.dev' is registered; it also runs on subdomain 'webproxy.goku8'. Its registrable label 'workers' stretches across 7 characters holding 2 vowels versus 5 consonants. Breaking it apart gives one word: workers. Median word length is 7 characters. No strong language cues emerged from the frequency lists.

Screenshot

to main content ATMs/Locations [MENU] How can we help? + Find a location Ley, State or 21P [Go] © Make an appointment ick hel ‘© Customer service and FAQs © Find routing and account numbers P...

Page Load Overview

0.99s

Total Load Time

1.0 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:27,048 chars

Detector Agreement:98%

All Detected Languages

🇺🇸en(99%)🇩🇪de(1%)

Website Classification

Primary Category

finance banking93% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

finance banking

93%

technology software

87%

government public service

69%

cryptocurrency blockchain

65%

social media network

62%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
29	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	3.229.29.73Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
3	23.50.131.146Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
2	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	23.32.242.175Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS16625Akamai Technologies, Inc.
2	23.50.131.150Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
2	104.18.32.137Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	172.64.155.119Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	34.202.158.248Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
2	40.180.127.30Aws · CLOUD	Dublin, Leinster, Ireland	AS16509Amazon.com, Inc.
59	25	-	-