wetransfer-com-downloads-3f8e2fd3a6[.]vercel[.]app

This domain, wetransfer-com-downloads-3f8e2fd3a6.vercel.app, poses a targeted brand impersonation threat against WeTransfer, a widely used file-sharing platform. Analysis indicates the domain was designed to mimic legitimate WeTransfer download pages, as evidenced by its page title, 'WeTransfer - Download Files,' and its use of WeTransfer branding elements. Such impersonation campaigns typically aim to deceive users into downloading malicious payloads or divulging sensitive credentials under the guise of legitimate file retrieval. The risk is elevated due to the domain's ability to exploit user trust in the WeTransfer brand, potentially leading to unauthorized access or malware distribution. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or scrutiny. The domain resolves to the IP address 216.198.79.3, hosted on Amazon.com, Inc.'s infrastructure (AS16509) in the United States. Detection metrics further underscore its malicious nature: 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WR1), provides a veneer of legitimacy but does not mitigate the underlying threat. Users who visited wetransfer-com-downloads-3f8e2fd3a6.vercel.app should immediately cease any interaction with the domain and assume potential exposure. If credentials were entered, they must be changed across all platforms where reused, and multi-factor authentication should be enabled where available. Devices used to access the domain should undergo a full security scan to detect any installed malware or unauthorized modifications. Organizations are advised to update their security blocklists to include this domain and monitor for signs of compromise, such as unusual login attempts or data exfiltration. Given the domain's current offline status, continued vigilance is necessary, as threat actors may redeploy similar infrastructure under new domains.