Phishing sites impersonating Wetransfer

PhishDestroy has recorded 52 phishing domains impersonating Wetransfer since 2025-08-25, 5 of them in the last 30 days. The most used registrars are Netlify and GoDaddy.com; the most common TLDs are .app and .com. Open Wetransfer only from its official app or a saved bookmark.

52
Domains, all time
5
Last 30 days
24
Online at last check
12
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 12026-08-07: 02026-08-08: 22026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 12026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 12026-08-24: 12026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 12026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 22026-09-10: 02026-09-11: 12026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 12026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 12026-09-26: 02026-09-27: 32026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 12026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Wetransfer phishing domains detected per day: 16 from 2026-07-25 to 2026-10-22; peak 3.

How to tell a fake Wetransfer site

Words most often added to the brand in reported domains: edgeone, appwrite, manatee, everland, transfer, order, tranfer, bafybeias, wqpscrcyqj, vhsimyzrc.

  • Type the address yourself or use a bookmark; phishing links for Wetransfer arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Wetransfer does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Wetransfer phishing domains

The 50 most recently detected domains impersonating Wetransfer
DomainFirst detectedStatus at last checkRegistrar
ueya.mx2026-10-11OnlineAKKY ONLINE SOLUTIONS, DE C.V
amarulalodgewau.com2026-09-27OnlineGoDaddy.com
iod-consult.com2026-09-27OnlineAscio Technologies
airstayroom.com2026-09-27OfflineGoDaddy.com
avonspecialtymetals.iceiy.com2026-09-25OnlinePorkbun
we-tranfer-fdownload.vercel.app2026-09-17OnlineVercel
we-tranfer-filedownload.vercel.app2026-09-11OnlineVercel
insourcehealthcare.com2026-09-09OnlineGoDaddy.com
order-dpihckhmxrid.edgeone.dev2026-09-09OnlineTencent Cloud
cpm-mza.com.ar2026-09-05Online—
wetransf3r.github.io2026-08-24OfflineGitHub
tavareslopes.adv.br2026-08-23Online—
resplendent-lamington-ac2b23.netlify.app2026-08-12OfflineNetlify
qerwrrsfwetrans.edgeone.dev2026-08-08OnlineTencent Cloud
wetransfer-sampleproduct-transfer.netlify.app2026-08-08OfflineNetlify
wefiletransfer0562026.edgeone.dev2026-08-06OnlineTencent Cloud
sheer-red-lwi8kl5b.edgeone.dev2026-07-21OnlineTencent Cloud
security-page-editor--gtwilliamsconst.replit.app2026-07-16OnlineReplit
3482865.zk622872.web.hosting-test.net2026-06-30OfflineHosting Ukraine
igit.me2026-06-30OfflineNAMECHEAP
delvaie.com2026-06-29OfflineOwnRegistrar
authwe-conne.xyz2026-06-28OfflineDYNADOT
riciclacarta.it2026-06-25OfflineServer Plan s.r.l
alinan-dpev5em6n4nz.edgeone.cool2026-06-18OnlineDNSPod
descaro.com2026-06-17OfflineTECNOCRATICA CENTRO DE DATOS, S.L
ka.bjpglyg.com2026-06-17OfflineIONOS SE
innovative-pyramid-715701.framer.app2026-05-31Taken downFramer
narangarav.vercel.app2026-05-14Taken downVercel
order27895.netlify.app2026-05-13Taken downNetlify
arrangehimalayas.com2026-05-08OfflineNameSilo
easier-video-999892.framer.app2026-04-29OfflineFramer
altruistic-successes-879938.framer.app2026-04-27OfflineFramer
abba-unick.com2026-04-09OfflineCosmotown
wetoto.appwrite.network2026-03-22OnlineAppwrite
westandard.appwrite.network2026-03-18OnlineAppwrite
wetransfer.appwrite.network2026-03-12OnlineAppwrite
69944e21b720f4bece44ad1d--astounding-manatee-da098c.netlify.app2026-03-05OfflineNetlify
wetransfer-pages-dev.netlify.app2026-02-24OfflineName.com, (Netlify)
wetransfer0.godaddysites.com2026-02-19OnlineGoDaddy.com
salmon-deena-43.tiiny.site2026-02-11OnlineNameCheap
wetransfer-com-downloads-3f8e2fd3a6.vercel.app2026-02-09OfflineTucows Domains
wetransferaudit2026docx.appwrite.network2026-01-25Taken downGoDaddy.com
weteranfierts.r-monecaoe.co2026-01-21Taken downDynadot
we2transfer-9iyd.vercel.app2025-12-27Taken downVercel
the-distinguished-invite-ptkfawjo-drakoleva.4everland.app2025-12-25Taken downCloudflare
invitation-bassoon-docs-s0c0dxek-donatusclems.4everland.app2025-12-21Taken downCloudflare
clinicasrecell.ninogutierrez.com2025-12-07OfflinePublicDomainRegistry.com
auth-wetransfer-com-4c95d-5d82f-6f882c.vercel.app2025-12-03Taken downVercel
dancing-souffle-bd19d9.netlify.app2025-11-06Taken downNetlify
spontaneous-manatee-e1e35c.netlify.app2025-10-19Taken downNetlify

All 52 Wetransfer reports

Where they are registered and hosted

Registrars

  1. Netlify6
  2. GoDaddy.com5
  3. Tencent Cloud4
  4. Vercel3
  5. Appwrite3
  6. Framer3
  7. Cloudflare2
  8. Vercel2

Top-level domains

  1. .app19
  2. .com12
  3. .network4
  4. .dev4
  5. .net2
  6. .link1
  7. .co1
  8. .site1

Hosting networks

  1. Amazon.com, Inc.8
  2. AMAZON-02 - Amazon.com, Inc., US6
  3. AMAZON-02, US4
  4. ACE-AS-AP - ACE, SG4
  5. CLOUDFLARENET, US2
  6. FASTLY - Fastly, Inc., US2
  7. Fastly, Inc.2
  8. Ukraine-AS Hosting Ukraine LTD, UA2

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Wetransfer; share of all PhishDestroy reports: 0.02%.