# Phishing sites impersonating Wetransfer

PhishDestroy has recorded 52 phishing domains impersonating Wetransfer since 2025-08-25, 5 of them in the last 30 days. The most used registrars are Netlify and GoDaddy.com; the most common TLDs are .app and .com. Open Wetransfer only from its official app or a saved bookmark.

52Domains, all time

5Last 30 days

24Online at last check

12Confirmed takedowns

## New domains in the last 90 days

Wetransfer phishing domains detected per day: 16 from 2026-07-25 to 2026-10-22; peak 3.

## How to tell a fake Wetransfer site

Words most often added to the brand in reported domains: edgeone, appwrite, manatee, everland, transfer, order, tranfer, bafybeias, wqpscrcyqj, vhsimyzrc.
- Type the address yourself or use a bookmark; phishing links for Wetransfer arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Wetransfer does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Wetransfer phishing domains

The 50 most recently detected domains impersonating Wetransfer
Domain | First detected | Status at last check | Registrar | 
[ueya.mx](https://phishdestroy.io/domain/ueya.mx/) | 2026-10-11 | Online | AKKY ONLINE SOLUTIONS, DE C.V | 
[amarulalodgewau.com](https://phishdestroy.io/domain/amarulalodgewau.com/) | 2026-09-27 | Online | GoDaddy.com | 
[iod-consult.com](https://phishdestroy.io/domain/iod-consult.com/) | 2026-09-27 | Online | Ascio Technologies | 
[airstayroom.com](https://phishdestroy.io/domain/airstayroom.com/) | 2026-09-27 | Offline | GoDaddy.com | 
[avonspecialtymetals.iceiy.com](https://phishdestroy.io/domain/avonspecialtymetals.iceiy.com/) | 2026-09-25 | Online | Porkbun | 
[we-tranfer-fdownload.vercel.app](https://phishdestroy.io/domain/we-tranfer-fdownload.vercel.app/) | 2026-09-17 | Online | Vercel | 
[we-tranfer-filedownload.vercel.app](https://phishdestroy.io/domain/we-tranfer-filedownload.vercel.app/) | 2026-09-11 | Online | Vercel | 
[insourcehealthcare.com](https://phishdestroy.io/domain/insourcehealthcare.com/) | 2026-09-09 | Online | GoDaddy.com | 
[order-dpihckhmxrid.edgeone.dev](https://phishdestroy.io/domain/order-dpihckhmxrid.edgeone.dev/) | 2026-09-09 | Online | Tencent Cloud | 
[cpm-mza.com.ar](https://phishdestroy.io/domain/cpm-mza.com.ar/) | 2026-09-05 | Online | — | 
[wetransf3r.github.io](https://phishdestroy.io/domain/wetransf3r.github.io/) | 2026-08-24 | Offline | GitHub | 
[tavareslopes.adv.br](https://phishdestroy.io/domain/tavareslopes.adv.br/) | 2026-08-23 | Online | — | 
[resplendent-lamington-ac2b23.netlify.app](https://phishdestroy.io/domain/resplendent-lamington-ac2b23.netlify.app/) | 2026-08-12 | Offline | Netlify | 
[qerwrrsfwetrans.edgeone.dev](https://phishdestroy.io/domain/qerwrrsfwetrans.edgeone.dev/) | 2026-08-08 | Online | Tencent Cloud | 
[wetransfer-sampleproduct-transfer.netlify.app](https://phishdestroy.io/domain/wetransfer-sampleproduct-transfer.netlify.app/) | 2026-08-08 | Offline | Netlify | 
[wefiletransfer0562026.edgeone.dev](https://phishdestroy.io/domain/wefiletransfer0562026.edgeone.dev/) | 2026-08-06 | Online | Tencent Cloud | 
[sheer-red-lwi8kl5b.edgeone.dev](https://phishdestroy.io/domain/sheer-red-lwi8kl5b.edgeone.dev/) | 2026-07-21 | Online | Tencent Cloud | 
[security-page-editor--gtwilliamsconst.replit.app](https://phishdestroy.io/domain/security-page-editor--gtwilliamsconst.replit.app/) | 2026-07-16 | Online | Replit | 
[3482865.zk622872.web.hosting-test.net](https://phishdestroy.io/domain/3482865.zk622872.web.hosting-test.net/) | 2026-06-30 | Offline | Hosting Ukraine | 
[igit.me](https://phishdestroy.io/domain/igit.me/) | 2026-06-30 | Offline | NAMECHEAP | 
[delvaie.com](https://phishdestroy.io/domain/delvaie.com/) | 2026-06-29 | Offline | OwnRegistrar | 
[authwe-conne.xyz](https://phishdestroy.io/domain/authwe-conne.xyz/) | 2026-06-28 | Offline | DYNADOT | 
[riciclacarta.it](https://phishdestroy.io/domain/riciclacarta.it/) | 2026-06-25 | Offline | Server Plan s.r.l | 
[alinan-dpev5em6n4nz.edgeone.cool](https://phishdestroy.io/domain/alinan-dpev5em6n4nz.edgeone.cool/) | 2026-06-18 | Online | DNSPod | 
[descaro.com](https://phishdestroy.io/domain/descaro.com/) | 2026-06-17 | Offline | TECNOCRATICA CENTRO DE DATOS, S.L | 
[ka.bjpglyg.com](https://phishdestroy.io/domain/ka.bjpglyg.com/) | 2026-06-17 | Offline | IONOS SE | 
[innovative-pyramid-715701.framer.app](https://phishdestroy.io/domain/innovative-pyramid-715701.framer.app/) | 2026-05-31 | Taken down | Framer | 
[narangarav.vercel.app](https://phishdestroy.io/domain/narangarav.vercel.app/) | 2026-05-14 | Taken down | Vercel | 
[order27895.netlify.app](https://phishdestroy.io/domain/order27895.netlify.app/) | 2026-05-13 | Taken down | Netlify | 
[arrangehimalayas.com](https://phishdestroy.io/domain/arrangehimalayas.com/) | 2026-05-08 | Offline | NameSilo | 
[easier-video-999892.framer.app](https://phishdestroy.io/domain/easier-video-999892.framer.app/) | 2026-04-29 | Offline | Framer | 
[altruistic-successes-879938.framer.app](https://phishdestroy.io/domain/altruistic-successes-879938.framer.app/) | 2026-04-27 | Offline | Framer | 
[abba-unick.com](https://phishdestroy.io/domain/abba-unick.com/) | 2026-04-09 | Offline | Cosmotown | 
[wetoto.appwrite.network](https://phishdestroy.io/domain/wetoto.appwrite.network/) | 2026-03-22 | Online | Appwrite | 
[westandard.appwrite.network](https://phishdestroy.io/domain/westandard.appwrite.network/) | 2026-03-18 | Online | Appwrite | 
[wetransfer.appwrite.network](https://phishdestroy.io/domain/wetransfer.appwrite.network/) | 2026-03-12 | Online | Appwrite | 
[69944e21b720f4bece44ad1d--astounding-manatee-da098c.netlify.app](https://phishdestroy.io/domain/69944e21b720f4bece44ad1d--astounding-manatee-da098c.netlify.app/) | 2026-03-05 | Offline | Netlify | 
[wetransfer-pages-dev.netlify.app](https://phishdestroy.io/domain/wetransfer-pages-dev.netlify.app/) | 2026-02-24 | Offline | Name.com, (Netlify) | 
[wetransfer0.godaddysites.com](https://phishdestroy.io/domain/wetransfer0.godaddysites.com/) | 2026-02-19 | Online | GoDaddy.com | 
[salmon-deena-43.tiiny.site](https://phishdestroy.io/domain/salmon-deena-43.tiiny.site/) | 2026-02-11 | Online | NameCheap | 
[wetransfer-com-downloads-3f8e2fd3a6.vercel.app](https://phishdestroy.io/domain/wetransfer-com-downloads-3f8e2fd3a6.vercel.app/) | 2026-02-09 | Offline | Tucows Domains | 
[wetransferaudit2026docx.appwrite.network](https://phishdestroy.io/domain/wetransferaudit2026docx.appwrite.network/) | 2026-01-25 | Taken down | GoDaddy.com | 
[weteranfierts.r-monecaoe.co](https://phishdestroy.io/domain/weteranfierts.r-monecaoe.co/) | 2026-01-21 | Taken down | Dynadot | 
[we2transfer-9iyd.vercel.app](https://phishdestroy.io/domain/we2transfer-9iyd.vercel.app/) | 2025-12-27 | Taken down | Vercel | 
[the-distinguished-invite-ptkfawjo-drakoleva.4everland.app](https://phishdestroy.io/domain/the-distinguished-invite-ptkfawjo-drakoleva.4everland.app/) | 2025-12-25 | Taken down | Cloudflare | 
[invitation-bassoon-docs-s0c0dxek-donatusclems.4everland.app](https://phishdestroy.io/domain/invitation-bassoon-docs-s0c0dxek-donatusclems.4everland.app/) | 2025-12-21 | Taken down | Cloudflare | 
[clinicasrecell.ninogutierrez.com](https://phishdestroy.io/domain/clinicasrecell.ninogutierrez.com/) | 2025-12-07 | Offline | PublicDomainRegistry.com | 
[auth-wetransfer-com-4c95d-5d82f-6f882c.vercel.app](https://phishdestroy.io/domain/auth-wetransfer-com-4c95d-5d82f-6f882c.vercel.app/) | 2025-12-03 | Taken down | Vercel | 
[dancing-souffle-bd19d9.netlify.app](https://phishdestroy.io/domain/dancing-souffle-bd19d9.netlify.app/) | 2025-11-06 | Taken down | Netlify | 
[spontaneous-manatee-e1e35c.netlify.app](https://phishdestroy.io/domain/spontaneous-manatee-e1e35c.netlify.app/) | 2025-10-19 | Taken down | Netlify | 

[All 52 Wetransfer reports](https://phishdestroy.io/domain/?brand=Wetransfer)

## Where they are registered and hosted

### Registrars

- Netlify6
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)5
- Tencent Cloud4
- Vercel3
- Appwrite3
- Framer3
- Cloudflare2
- Vercel2

### Top-level domains

- [.app](https://phishdestroy.io/tld/app/)19
- [.com](https://phishdestroy.io/tld/com/)12
- [.network](https://phishdestroy.io/tld/network/)4
- [.dev](https://phishdestroy.io/tld/dev/)4
- [.net](https://phishdestroy.io/tld/net/)2
- [.link](https://phishdestroy.io/tld/link/)1
- [.co](https://phishdestroy.io/tld/co/)1
- [.site](https://phishdestroy.io/tld/site/)1

### Hosting networks

- Amazon.com, Inc.8
- AMAZON-02 - Amazon.com, Inc., US6
- AMAZON-02, US4
- ACE-AS-AP - ACE, SG4
- CLOUDFLARENET, US2
- FASTLY - Fastly, Inc., US2
- Fastly, Inc.2
- Ukraine-AS Hosting Ukraine LTD, UA2

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Wetransfer; share of all PhishDestroy reports: 0.02%.

Canonical: https://phishdestroy.io/brand/wetransfer/