Security Scan Report: webproxy.goku8.workers.dev

Site favicon
Submitted: Completed: publiccompleted
This website contacted 11 IPs in 3 countries across 10 domains to perform 79 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://webproxy.goku8.workers.dev/https://www.wellsfargoadvisors.com/services/intuitive-investor.htm?cid=WF2200032863

AI Security Verdict

Confirmed Scam

Confidence: 88%

9
Risk Score

Cloned Wells Fargo Advisors investing page served via a workers.dev proxy and flagged by Safe Browsing for social engineering. Do not enter any credentials; use wellsfargo.com directly.

Risk Factors (5)
Google Safe Browsing social engineering threat
Financial brand impersonation on an unrelated proxy host
Sign-on and client-login entry points presented under the Wells Fargo name
Page content mirrors a bank's site through a third-party proxy URL
Hosting on a free platform subdomain with unknown page age
Domain age information unavailable

Details

Page Title

Automated Investing with Robo Advisor | Wells Fargo Advisors Intuitive Investor

Scan Type

public

Domain Name Analysis

Domain 'webproxy.goku8.workers.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'webproxy.goku8'. The registrable portion 'workers' spans 7 characters containing two vowels alongside 5 consonants. It segments into 1 word: workers. No strong language cues emerged from the frequency lists.

Screenshot

WELLS FARGO Sign On | ContactUs | OpenanAccount | Search [e:Wells Fargo Advisors Find an Advisor by ZIP { t co) Products & Services » Ways to Work WithUs y Planning For Life » | OurInsights » Adviso...

Page Load Overview

2.08s
Total Load Time
2.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:15,610 chars
Detector Agreement:100%

All Detected Languages

🇺🇸en(99%)🇩🇪de(1%)

Website Classification

Primary Category

finance banking69% confidence
Type: spa
Method: ml+structural

All Detected Categories

finance banking
69%
adult content
66%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
69188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
752.18.14.145Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
754.229.115.211Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
7172.64.155.119Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
754.155.178.220Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
763.140.62.200Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
72.17.100.155Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
765.9.130.12Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
713.32.121.93Cloudfront · CDNNew York, New York, United States
AS16509Amazon.com, Inc.
7911--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T132546457BDE0121AC7E78345AA567B88B952980FFC7269CCF1AD03784FCDBE26C12509

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:eoZV+8RxDopU6Dmy9gylWLepH8xyCglSzwwv10B5fE3eDCSohAArxyCglSzLBG1D:eoZQ8R5oHghg

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:298269:YDAEKBkmSVgjbJOEsGooCAycCUACESQoACkAj1ROMiXIkEkvWzAlEIckZCZHUQwAmhEQQKMMAEJrAFA6TpKSRtCGCWHVUBAQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffffffffe7ffff
Perceptual Hash:f25a6a724853671d
Difference Hash:8d2500010f0f0b17
Wavelet Hash:0000ffffc3c3e781
Color Hash:07e02000000

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data