Wells Fargo

Banking United Stateswellsfargo.comRank 25 of the most impersonated
Cert findings · 24 h
0
Cert findings · 7 days
4
4 on phishing hosts
Registered lookalikes
119
20 listed by a source or an address list
Official domains
49
verified from Wells Fargo's own sites and records

Certificate findings for Wells Fargo

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Wells Fargo's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 4 findings, grouped by hostname

  1. wellsfargohelp.support CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 11 mo ago
    DetailsHide
    Hostname
    wellsfargohelp.support
    First seen
    2026-11-03 11:06 UTC
    First published
    2026-11-03 12:13 UTC
    DNS
    Resolves · checked 2026-11-04 12:24 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 10:04 UTC to 2027-02-01 10:04 UTC
    Logged 2026-11-03 11:03 UTC in Google PlumbersArms2027h1, entry 589,365,249
    SHA-256 0c840f1cb7ee6496f19b0cf2482fa856b52b11f8c4a0c4a45251266c4cf878da
    Public key SHA-256 e935c8e8eca367d0ea99ee561f887e328dee70380b7cc9fe6695f773b48bddb2
    Brand
    Wells Fargo
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    wellsfargohelp.support
    Registered
    2025-12-06 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 12:16 UTC

    Suggest a correction

  2. www.wellsfargohelp.support CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 11 mo ago
    DetailsHide
    Hostname
    www.wellsfargohelp.support
    First seen
    2026-11-03 11:06 UTC
    First published
    2026-11-03 12:13 UTC
    DNS
    Resolves · checked 2026-11-04 12:24 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 10:04 UTC to 2027-02-01 10:04 UTC
    Logged 2026-11-03 11:03 UTC in Google PlumbersArms2027h1, entry 589,365,249
    SHA-256 0c840f1cb7ee6496f19b0cf2482fa856b52b11f8c4a0c4a45251266c4cf878da
    Public key SHA-256 e935c8e8eca367d0ea99ee561f887e328dee70380b7cc9fe6695f773b48bddb2
    Brand
    Wells Fargo
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    wellsfargohelp.support
    Registered
    2025-12-06 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 12:16 UTC

    Suggest a correction

  3. wellsfargo-ny.com AE · AS60117 · HS Host Sailor Ltd
    Phishing hostSame certificateAddress hosted confirmed phishing in the last 48 h · Same certificate as barclays-groups.com, on a phishing host at 185.198.59.26MX presentSPF ~allDMARC policy noneRegistered 8 mo ago
    DetailsHide
    Hostname
    wellsfargo-ny.com
    First seen
    2026-11-02 10:21 UTC
    First published
    2026-11-02 10:48 UTC
    DNS
    Resolves · checked 2026-11-04 11:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.198.59.26.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.198.59.26
    4. Latest DNS check
    Same certificate
    Same certificate as barclays-groups.com: on a phishing host at 185.198.59.26; a Barclays lookalike
    Wells Fargo appears in this hostname
    Resolved to 185.198.59.26, an address that hosted confirmed phishing
    Certificate c6449115771f95ea… · 3 domains on it · first seen 2026-11-02 10:21 UTC
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 09:19 UTC to 2027-01-31 09:19 UTC
    Logged 2026-11-02 10:18 UTC in Geomys Tuscolo2027h1, entry 443,817,593
    SHA-256 c6449115771f95ea82d33ca0a49eac6950837c0e26ac82c8c4ace6215a031880
    Public key SHA-256 c96647c01509ea4bb7f564bd5e791f3b3944d51298448741ebf6ee76bb0f1c81
    Brand
    Wells Fargo
    Addresses
    185.198.59.26 · United Arab Emirates · AS60117 HS Host Sailor Ltd
    Domain
    wellsfargo-ny.com
    Registered
    2026-03-10 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Receives mail at wellsfargo-ny.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  4. www.wells-fargo-login-attempt.jamesliccione.com US · AS32475 · Internap Holding LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 20 y ago
    DetailsHide
    Hostname
    www.wells-fargo-login-attempt.jamesliccione.com
    First seen
    2026-10-30 13:52 UTC
    First published
    2026-10-30 14:56 UTC
    DNS
    Resolves · checked 2026-11-04 15:03 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.175.102.130.
    1. Resolved to 69.175.102.130
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Wells Fargo
    Addresses
    69.175.102.130 · United States · AS32475 SINGLEHOP-LLC - Internap Holding LLC
    Domain
    jamesliccione.com
    Registered
    2006-07-12 · GoDaddy.com, LLC
    MX
    Receives mail at jamesliccione.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Wells Fargo when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Banking

All brands →