welf2805-ffhmfsdfcaa8anav[.]canadacentral-01[.]azurewebsites[.]net

This domain presents a high-risk generic phishing threat designed to harvest user credentials by impersonating a legitimate financial institution login portal. The page displays a Wells Fargo-branded interface with fields for username and password, targeting customers attempting to access personal accounts. Analysis indicates the site is actively collecting sensitive authentication details, which may be used for unauthorized account access or financial fraud. Infrastructure analysis reveals the domain is hosted on Microsoft Azure cloud services, resolving to the IP address 20.48.204.15. The SSL certificate is issued by Microsoft Corporation, a common characteristic of legitimate cloud-hosted services that threat actors exploit to appear trustworthy. Detection data shows 9 of 95 security vendors on VirusTotal have flagged this domain as malicious, with Google Safe Browsing specifically categorizing it as social engineering content. The domain remains active as of this analysis, with no indication of takedown by the registrar. Users who have visited this domain and entered credentials should immediately change their login details for the legitimate financial institution. Enable multi-factor authentication on all accounts to add an additional security layer. Monitor financial statements for unauthorized transactions and report any suspicious activity to the legitimate service provider. Security teams should block the IP address 20.48.204.15 and the full domain at network perimeter controls to prevent access from corporate environments. The combination of cloud hosting and legitimate-looking SSL certificates demonstrates how threat actors leverage trusted infrastructure to enhance phishing campaign effectiveness.