connect[.]secure[.]wellsrfargo-srv[.]kjlj[.]com

This domain, connect.secure.wellsrfargo-srv.kjlj.com, is a sophisticated phishing site designed to look like a legitimate Wells Fargo login page. It tricks users into entering their credentials by displaying a page titled "Sign On to View Your Personal Accounts | Wells Fargo." The threat is brand impersonation, aiming to steal sensitive financial information. The site is now offline, but anyone who visited it before takedown may have compromised their account.

PhishDestroy's investigation uncovered several red flags. VirusTotal flagged the domain with 24 out of 95 security vendors marking it as malicious, including Google Safe Browsing listing it as phishing. The domain was created on December 19, 2008, and registered through VM SINO PROFIT (HK) LTD., a registrar often associated with suspicious domains. It resolved to IP address 20.70.131.38 and had an SSL certificate from R12. These indicators, combined with its appearance on one security blocklist, confirm its malicious intent.

If you visited this site and entered any login details, change your Wells Fargo password immediately and enable two-factor authentication. Monitor your accounts for unauthorized activity and contact Wells Fargo's fraud department. Avoid entering credentials on any site where the URL looks slightly off or contains unexpected subdomains like "connect.secure.wellsrfargo-srv.kjlj.com." Always verify the official domain before signing in.