0wf0acct[.]us

This domain, 0wf0acct.us, poses a direct threat to users by impersonating Wells Fargo’s official sign-on portal. The site mimics legitimate banking authentication pages, tricking visitors into entering sensitive login credentials, which are then harvested by threat actors. Such credential theft can lead to unauthorized account access, financial fraud, and identity compromise, particularly targeting customers of the impersonated financial institution.

Analysis indicates the domain was registered on December 21, 2025, through NameSilo, LLC, a registrar frequently observed in phishing operations. Infrastructure review reveals the site lacks an SSL certificate, increasing exposure to interception risks. VirusTotal detection data shows 14 out of 95 security vendors flag the domain as malicious, while it resolves to 172.67.169.61, an IP address hosted on Cloudflare’s network (AS13335). The page title, 'Wells Fargo - Sign On,' further confirms the intent to deceive users into believing they are accessing a legitimate banking service.

If you visited 0wf0acct.us, immediately cease all interaction and avoid entering any credentials. Notify your financial institution to monitor for unauthorized transactions and consider placing a fraud alert on your accounts. Reset passwords for any accounts accessed or credentials entered on the site, prioritizing those linked to financial services. Review recent transaction history for anomalies and report the incident to relevant cybersecurity authorities or anti-fraud organizations for further mitigation.