wesharesfile[.]com

This domain, wesharesfile.com, is flagged as an active credential-phishing operation targeting Binance users. Registered on May 19, 2026, through TUCOWS.COM, CO., the domain resolves to IP address 89.46.105.44, hosted by Aruba S.p.A. in Italy. Infrastructure analysis reveals the use of nameservers dns.technorail.com, dns2.technorail.com, dns3.arubadns.net, and dns4.arubadns.cz, alongside a single MX record pointing to mx.wesharesfile.com with priority 10. The SSL certificate is issued by Actalis S.p.A. under the Actalis Organization Validated Server CA G3, a common choice for both legitimate and malicious domains. At the time of assessment, the domain returns an HTTP 200 status with a page title of 'Maintenance,' a tactic frequently employed by threat actors to mask malicious activity or simulate downtime while harvesting credentials. Fifteen of ninety-one security vendors on VirusTotal have flagged this domain, and it appears on at least one security blocklist. While the exact phishing kit or payload is not yet analysed, the combination of brand impersonation, recent registration, and infrastructure hosted on a provider with a history of abuse strongly indicates malicious intent. Defenders should treat this domain as high-risk and prioritise blocking at DNS, IP, and certificate levels. Monitoring for related domains registered through the same registrar or hosted on the same IP range may uncover additional threats. The domain remains active as of July 12, 2026, and no evidence suggests takedown or mitigation efforts.