Can't connect to Wells Fargo, recognized as phishing URL

Viruses and worms
1

I normally do my banking with Wells Fargo using their app on my phone. But I need to print out a few things so I went to connect to their site on my computer, and I immediately got an alert. It told me that it was infected with URL:Phishing. I haven’t attempted to log in on my computer in a while, so this caught me off guard. I don’t even know how long this has been going on. And I’m not sure what caused it or what to do. I’m currently doing a search but very little is coming up, even on here, but none of it is very helpful. So while I figure this out, I have to make print outs from somewhere else. If someone here can help I’d really appreciate it. Thanks.[/img][/img]

2

You can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php

3

This uri is not flagged by avast: -https://connect.secure.wellsfargo.com/auth/login/present?origin=tpb
Avast says: This website is safe.

Are you sure you have landed onto the genuine legit page and weren’t somehow maliciously being redirected?

polonus

4

Probably got the Avast Alarm on the Wells Fargo main website… https://www.wellsfargo.com. Not the online banking URL connect.wellsfargo.com.

I can confirm the same trouble.

I cannot confirm if the site is or is not infected in anyway… as AVAST is blocking access to the site.

5

No alert on the main wellsfargo.com page.

EDIT: Added attached image.

6

Hi DavidR,

Thanks for confirming, my good forum friend,
so it must be something we are “missing out” in the old world.

DavidR is stationed in the UK and I am finding myself near Rotterdam in the Netherlands.
and that’s on both sides of the North Sea.

So we’d better wait for avast’s final verdict from the new world,
where the firm is also stationed to find out
about what experience avast staff has with this issue from there.

polonus

7

That’s the problem I’m having. It’s with www.wellsfargo.com. Nothing loads when I go to connect.wellsfargo.com but when I go to connect.secure.wellsfargo.com the page loads as normal. No warnings or alerts. It’s weird.

8

Just for the record, it currently gets blocked here.

9

Still not getting blocked using the link from chriskoc0927 gave.

I don’t know if this is my Browser, Add-ons, setup, etc.

I was also able to get to connect.secure.wellsfargo.com/auth/login/present?origin=tpb and no alert, very strange.

10

Hi DavidR,

Also can get there and then see this inside the code

-
&

nonce="8fbf81a5-XXXX-4803-YYYY-f88c6ec62877"> document.documentElement.className = document.documentElement.className.replace(/(^|\s)no-js(\s|$)/, '$1$2');
this is a security identifier aka SID. (hxtp XXXX YYYY dot com added by me for obvious reasons ;)

kind regards,

polonus

11

Interesting, the tridion.com redirects to hXXps://wXw.sdl.com/ I wonder what that’s all about ?

Also see https://sitecheck.sucuri.net/results/tridion.com medium security risk.
And https://webhint.io/scanner/70a88ce3-55fd-4903-bdce-e3b8cb2a98da

12

Update, it doesn’t get blocked here anymore either.