New Registrations

WeTransfer phishing domains

Newly registered lookalikes - tracked daily

WeTransfer phishing domains

Newly registered lookalikes - tracked daily

Website
wetransfer.com
About
AIFile-transfer service. Phishing mimics a 'your file is ready' or 'someone shared a file with you' notification, routing to a fake download-gate login that harvests email or cloud credentials.
TLDs
.dev (2) · .com (2) · .br (1)
Hosts
Oracle Corporation (2) · ACE (2) · Host Africa (Pty) Ltd (1)
Countries
United StatesUnited States (2) · SingaporeSingapore (2) · South AfricaSouth Africa (1)
Historical record. phishunt is not tracking any newly-registered WeTransfer lookalike domain right now; the 6 entries below are from the 365-day archive (sites taken down, cleaned up, or otherwise inactive). Use them for retrospective analysis, not as a current threat-feed signal.
First seen URL IP Cert Detail
2026-09-27 https://amarulalodgewau.com/Wetransfer2/clients/ 173.254.126.115 - Archived
2026-09-21 https://eu-assets.contentstack.com/v3/assets/blt006917f377bafe00/blt0… 104.17.123.52 GandiCert Archived
2026-09-21 https://welxcufils.com.ng/kt/wetransfer-order 169.239.181.96 YE1 Archived
2026-09-13 http://wetransfer-east856-dppejjz76yzz.edgeone.dev 43.174.246.29 DigiCert Secure Site … Archived
2026-09-12 https://wetransferswiftserverr.edgeone.dev 43.174.247.29 DigiCert Secure Site … Archived
2026-08-23 https://tavareslopes.adv.br/co/wetransfer/ 192.185.216.47 YR1 Archived

AIHow to verify a real WeTransfer URL

  • Legitimate WeTransfer URLs always end in wetransfer.com (e.g. www.wetransfer.com, account.wetransfer.com). Anything else — including look-alike typosquats, hyphenated variations, or unfamiliar TLDs like .xyz / .top / .vip — is not WeTransfer.
  • The domains listed above were registered within the last 7 days. New-domain age is itself a signal — WeTransfer has owned wetransfer.com for years; brand-new look-alikes are almost never legitimate.
  • If you got the link from email, SMS, or social media, do not click it. Open wetransfer.com from your browser bookmark or type the domain manually.
  • Real WeTransfer pages almost never ask for credentials immediately after clicking from a message — treat any such redirect as a phishing attempt until the domain is verified.