Fake Wells Fargo website 818-869-4844

John from fake Wells Fargo can be reached at his Google Voice line 818-869-4844. His favorite color is red.

Google Sites page Wells Fargo Login – Secure Access to Accounts | Official Site links to

https://rebrand.ly/welfaroo , which redirects to

Log In , with fake error page

Error .

with tawk.to web chat account https://tawk.to/chat/69e8f4062764511c3261cb87/1jmqvifdk?pop=1

Sort of similar operation to these PayPal sites: Fake PayPal https://thakral.vercel.app/ .

The domain registration info is not redacted:

Roles:

  • registrant

Contact:

kind: individual

Name: Nick

Org: Nick

Address:

,New Push,J023
Delhi
Delhi
110083

Email: [email protected]

Tel: +91.9838483829 (voice)

Another site with the same domain registrar just came to my attention

https://sites.google.com/loginns1.com/venmo-login/ links to https://rebrand.ly/vennolog , which redirects to https://venmlog.info/log/ , with the fake error page https://venmlog.info/err/ .

Associated tawk.to web chat account https://tawk.to/chat/69eb6ead7c1b241c32bf65b8/1jmvqglt4?pop=1 .

On the same IP address:

GV - no answer.

I suspect that there are many Google Voice numbers for this group, and I would guess that they are mostly used for outbound calls.

I suspect that if you bait the scammers through the chat and the initial Google Voice callback more seriously than I tend to do (verifying their favorite color, etc…) you could uncover more valuable inbound phone numbers or other information.

Update: Eric William from Venmo Support can be reached at 857-232-8537 (Neutral Tandem). He refused to verify his favorite color.

Another phishing domain registered to the same account, this time impersonating Capital One Bank: https://rebrand.ly/cd42b7 redirects to Capital One Login, with fake error page Error! and tawk.to web chat account https://tawk.to/chat/698a2a7bc060e01c37489666/1jh1rbtfo?pop=1 .

Number is still active, Sam This Side from Wells Fargo. His favorite color is black.

After I reported their redirector/shortener URL at rebrand.ly, the scammers switched to another URL shortener service, https://dub.sh/wellsfalog . I am attempting to get this one shut down too.

Similar scheme: Google sites page Capital One Login – Manage Your Accounts Anytime links to Log In , error page Error , tawk.to web chat account https://tawk.to/chat/69f8ab781eeb261c3abd8840/1jnplrk21?pop=1

capisone.info is another domain registered by [email protected] , same as the fake Wells Fargo site above:

Now linking to https://rebrand.ly/127b43 , which redirects to

https://captoeo.info/slog/ (another [email protected] domain).

Error page https://captoeo.info/serr/ .

Now using a new redirector URL to link to the same venmlog.info website: https://rebrand.ly/venmll .

I got ahold of “David” through their tawk.to client, he said a “technician” will call me within 10-15 minutes. I have a strange suspicion that these chods are related to a PayPal scam operation I’ve also dealt with recently, but standby.

“Alex” called me from his personal TextNow line ‪(513) 666-6430‬ and asked for me to complete “verification steps” before falsely claiming the account was accessed from an iPhone and an Android phone and asking if I had a smartphone, despite the fact I had already told him I only access Venmo on my computer.

He never remotely accessed my virtual machine as a result, instead asking me to purchase a $500 Apple “security card” from a nearby grocery card on the grounds that my IP address was hacked. I used this as an opportunity to pull my “the bank will freeze my account” schtick, and he refused to “suppoat”

I called 513-666-6430 and Alex did identify as “Venmo Customer Support.”

His favorite color is black.

Now links to Login , error page Error! . Another domain registered by [email protected].

Tawk.to web chat widget https://tawk.to/chat/69eb6ead7c1b241c32bf65b8/1jmvqglt4?pop=1

New fake Wells Fargo site with the same template: Error .

Tawk.to web chat account https://tawk.to/chat/69f35d2ff1adf11c33bf98a6/1jnfa82gh?pop=1

Another [email protected] domain.

is still active, great job Google! Now it links to a new Wells Fargo phishing site,

Log In , error page Error , tawk.to web chat https://tawk.to/chat/69e8f4062764511c3261cb87/1jmqvifdk?pop=1 .

wellverlog.info domain name registration info is not redacted! wellverlog.info - bgp.he.net

Roles:

  • registrant

Contact:

kind: individual

Name: Jack Morris

Address:

,1260 Stelton Road
New Jersey
New Jersey
08854

Email: [email protected]

Tel: +1.2512924943 (voice)

This registration info has been connected to various financial/phishing websites for a long time, e.g. Tracking bank/crypto phishing gang(s) using Google Sites, Tawk.to, MS Azure sites, Wordpress, etc - #123 by ElmerFudde2020

Sam from Fake Wells Fargo has a Google Voice line 818-217-0652.

Same site, different pages: Capital One LoginVerify!Error!

with web chat widget https://tawk.to/chat/69f39603b402371c38a675c1/1jnfo406r?pop=1

Jack from Capital One has a Google Voice line 413-216-0241. His favorite color is pink.

This address in Piscataway is apparently the address of an “M&M Realty Partners LLC” registered to a Jack Morris: https://www.dnb.com/business-directory/company-profiles.mm_realty_partners_llc.5978cdf1f3454545d0d571f8eb3eb746.html

Active today, Alex is the Security Officer of Venmo, and he has an Onvoy VOIP line at 270-336-9982. He refused to verify his favorite color.