weteranfierts[.]r-monecaoe[.]co

This domain, weteranfierts.r-monecaoe.co, is identified as a brand impersonation threat targeting WeTransfer, a legitimate file-sharing service. The domain was specifically designed to mimic WeTransfer’s interface and functionality, likely to harvest user credentials, distribute malicious payloads, or facilitate unauthorized data transfers. Analysis confirms the domain is currently offline, though it remains a documented threat in recent security assessments. Infrastructure analysis reveals the domain was registered on July 20, 2025, through Dynadot LLC, a registrar commonly associated with high-risk domains. It resolves to the IP address 170.130.165.25, located in the United States under AS62904 (Eonix Corporation), a network frequently linked to fraudulent activity. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data. Security vendors have flagged this domain, with 24 out of 95 VirusTotal engines detecting it as malicious. Additionally, it appears on one security blocklist, specifically PhishDestroy, further corroborating its fraudulent nature. The page title, 'Wetransfer - Partage de document,' directly impersonates WeTransfer’s branding and language, targeting French-speaking users. Given the domain’s current offline status, immediate threats to end-users are mitigated. However, the infrastructure remains a potential risk for re-emergence or reuse in future campaigns. Organizations and individuals are advised to block the domain and its associated IP address (170.130.165.25) at the network level. Security teams should monitor for similar domains registered through Dynadot LLC or hosted on Eonix Corporation’s network, particularly those lacking SSL certificates. Users who may have interacted with this domain should reset credentials and scan systems for potential compromise. Proactive measures, such as implementing domain reputation checks and enforcing multi-factor authentication, are recommended to mitigate similar threats.