auth-wetransfer-com-4c95d-5d82f-6f882c[.]vercel[.]app

This domain, auth-wetransfer-com-4c95d-5d82f-6f882c.vercel.app, poses a specific threat of brand impersonation targeting WeTransfer users. The site was designed to mimic the legitimate WeTransfer service, potentially tricking users into divulging sensitive information such as login credentials, personal data, or financial details. Visiting this domain could lead to unauthorized access to user accounts, theft of personal information, and financial losses.

Analysis indicates that the domain is flagged by 19 out of 95 security vendors on VirusTotal, suggesting a high level of suspicion among the security community. The domain was registered through Vercel Inc. and used an SSL certificate issued by Google Trust Services, which can give a false sense of security to unsuspecting users. The IP address associated with this domain, 216.198.79.131, is located in the United States and belongs to AS16509 Amazon.com, Inc. Additionally, the site appears on two security blocklists, PhishDestroy and PhishingDB, further confirming its malicious nature. The domain is currently offline, but the risk remains if it is reactivated.

If a user has visited this domain, they should immediately change their WeTransfer account password and enable two-factor authentication (2FA) if not already enabled. It is also recommended to monitor the account for any unauthorized activity and to notify WeTransfer customer support about the potential breach. Users should be cautious of unexpected emails or messages asking for personal information and verify the authenticity of any communication purportedly from WeTransfer by visiting the official website directly.