we-tl-t-omj-s1b-qr-ci-sigma[.]vercel[.]app

This domain operates as a high-risk phishing site designed to impersonate WeTransfer, a legitimate file-sharing service. Visitors are presented with a fraudulent download page titled 'WeTransfer - Download Files,' which likely harvests login credentials, distributes malware, or tricks users into executing malicious files. The site mimics the appearance and functionality of the authentic WeTransfer platform, increasing the likelihood of successful deception, particularly among users expecting legitimate file transfers. Analysis indicates the domain was registered on May 20, 2026, through Vercel Inc., a hosting provider frequently exploited for phishing due to its free and easily deployable infrastructure. The domain resolves to the IP address 216.198.79.195, located in the United States and associated with Vercel’s network. Security vendors on VirusTotal have flagged this domain as malicious, with 18 out of 95 engines detecting it as phishing-related. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. If a user has interacted with this domain, immediate action is required to mitigate potential compromise. First, any credentials entered on the site should be changed from a secure device, and multi-factor authentication should be enabled if not already active. Users should scan their systems for malware using updated security tools, as the site may have delivered malicious payloads. If financial or sensitive information was submitted, affected accounts should be monitored for unauthorized activity, and a report should be filed with relevant fraud prevention services. Organizations should update their security blocklists to include this domain and its associated IP address to prevent further access.