wetransferaudit2026docx.appwrite.network is a brand impersonation threat targeting WeTransfer users. Detected by 19/95 security vendors, this domain mimics.
Hosting SSL Certificate Registration Form Blacklisted by Security Providers Long Term Domain Blacklisted
网络安全情报
Cloudflare Radar Verdict恶意
Phishing Security threats Phishing
证据摘要
关键
VirusTotal
15/91
URLScan
Stored capture
This domain, wetransferaudit2026docx.appwrite.network, is flagged as a brand impersonation threat specifically targeting WeTransfer, a widely used file-sharing platform. Analysis indicates the site replicates WeTransfer’s visual design and page title to deceive users into interacting with fraudulent content. The domain does not appear to deploy a crypto drainer or credential harvesting kit based on available telemetry, but its impersonation tactics align with campaigns designed to distribute malware or collect sensitive information under false pretenses. Infrastructure analysis reveals the domain was registered on June 28, 2022, through GoDaddy.com, LLC, and resolves to the IP address 151.101.67.52, geolocated within the United States under AS54113 (Fastly, Inc.). VirusTotal detection metrics show 19 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Certainly, a provider commonly used for both legitimate and malicious domains. Google Safe Browsing does not currently list the domain, though this may reflect a lag in detection rather than an absence of risk. As of the latest assessment, wetransferaudit2026docx.appwrite.network has been taken offline, likely in response to security vendor reports or registrar enforcement actions. However, the residual risk remains elevated due to the domain’s historical use in brand impersonation and its association with a content delivery network IP range that has hosted other malicious activity. Users who interacted with the domain prior to its takedown should monitor for unauthorized account access or unusual file activity, particularly if credentials or files were submitted. Organizations are advised to block the domain and IP at the network level and review logs for prior connections to mitigate potential exposure.
For the registrable domain appwrite.network behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprintab4fe143debe5caf2b0aa57ac75528529aeb3af669856693135c7cb3a266e788Certificate names · 2 SANs
appwrite.network
imagine.diy
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-12 10:06:59 UTC
RDAP registration未知
Observed timelinelast reachable: 2026-10-12 10:06:59 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
This timeline displays historical security and status checkpoints observed by the PhishDestroy automated monitoring network. It records domain lifecycle updates, scanner changes, and threat telemetry over time.
15 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
Web Archive
Preserved in 互联网档案馆 — historical evidence archived
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups+
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels+
Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
Send the report. Keep outgoing report records and recipient information when available.
Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
Gridinsoft Analysis
1 / 100
(US)
