wetransfer0[.]godaddysites[.]com

The domain wetransfer0.godaddysites.com has been identified as a brand impersonation threat specifically targeting WeTransfer. Analysis confirms the domain was designed to mimic the legitimate WeTransfer file-sharing service, as evidenced by the page title 'WeTransfer' and the use of the brand's visual identity. The domain is currently offline, though prior activity suggests it was actively used for phishing operations. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. Security vendor detections indicate 20 of 95 VirusTotal engines flagged the domain as malicious. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The creation date is anomalous, as it predates the current date, suggesting potential domain spoofing or a typo-squatting attempt. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future malicious activity. Organizations are advised to block the domain and associated IP address (13.248.243.5) at the network perimeter. Security teams should monitor for similar domains registered through the same registrar or hosted on identical infrastructure. Endpoint protection rules should be updated to include this domain in denylists, and users should be educated on recognizing brand impersonation tactics, particularly those mimicking file-sharing services.