wetransfer-customize-files-shared[.]netlify[.]app

Analysis of wetransfer-customize-files-shared.netlify.app indicates an active generic phishing infrastructure that was registered on June 08, 2026. The domain is hosted on Netlify, as evidenced by the registrar information, and therefore benefits from Netlify's default HTTPS certificate and global CDN edge network. VirusTotal reports that 17 of 91 security vendors have flagged the domain, demonstrating a moderate level of detection across the threat‑intelligence community.

The site is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing its classification as malicious. No additional intelligence such as page title, brand target, or observed payloads is available at this time, leaving the exact content and lure technique unconfirmed. Defenders should treat the domain as high‑risk, given the elevated risk rating and the presence of multiple vendor detections.

Recommended mitigation steps include adding the full hostname to network‑level deny lists, updating web‑proxy and DNS filtering rules to block the Netlify sub‑domain, and monitoring for any related Netlify‑hosted subdomains that share similar naming patterns. Continuous re‑evaluation is advised, as further analysis of the landing page, HTTP response headers, and potential credential‑stealing forms may reveal additional indicators of compromise.