wetransfer-app[.]com

This domain is flagged as an elevated-risk WeTransfer brand impersonation site specifically designed for credential theft. Analysis indicates the infrastructure was engineered to deceive users into submitting login credentials, file uploads, or other sensitive data under the false pretense of legitimate file-sharing services. The threat actor leveraged the trusted WeTransfer brand to increase the likelihood of successful compromise, a tactic commonly observed in targeted phishing campaigns against corporate and individual users. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain wetransfer-app.com was registered through REGISTER S.P.A. on June 01, 2026, an anomalous creation date suggesting domain spoofing or pre-emptive registration for fraudulent purposes. It resolves to the IP address 213.158.93.84, which lacks an SSL certificate, exposing all transmitted data to interception. VirusTotal reports 22 out of 95 security vendors flagging the domain as malicious, while PhishDestroy and at least one additional security blocklist have actively blocked it. The page title 'WET' further deviates from WeTransfer’s standard branding, reinforcing the fraudulent nature of the site. Mitigation against this credential theft threat requires immediate action from both end users and network administrators. Users who interacted with wetransfer-app.com should assume their credentials or uploaded files were compromised and initiate password resets for all associated accounts, particularly those tied to corporate or financial services. Multi-factor authentication (MFA) should be enforced wherever possible to mitigate unauthorized access. Network administrators are advised to block the domain and its resolving IP (213.158.93.84) at the firewall or DNS level, and monitor for outbound connections to these indicators. Security teams should also review logs for any prior interactions with the domain and conduct a forensic analysis of affected systems to identify potential data exfiltration. Given the domain’s current offline status, organizations should remain vigilant for similar impersonation attempts using slight variations of the WeTransfer brand or infrastructure.