other · NL

WeTransfer

WeTransfer B.V.

File-transfer service (owned by Bending Spoons since 2024); shared-file download lures.

Primary official domain
wetransfer.com
Reviewed official domains
2 (directory review; organization has not verified)
Directory source
DomainSpoof directory · Suggest a correction
Matching domains, 30 days
1
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
3
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 6/10 lookups · Mail: Not checked · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
wetransfer
Label aliases
WeTransfer
Official domains
wetransfer.com · we.tl (all)
Generated spellings
169 tracked · 0 observed somewhere · 169 not observed (all)

Certificate domains matching this brand

Names identified in certificate logs that match this company or brand. A brand match does not indicate bad intent or malicious activity.

Matching domain groups, 30 days
0
distinct registrable domains with a matching certificate name, by latest CT log time; not attacks
Reviewed official
0
groups on this organization's reviewed official domains, 30 days
Not assessed
0
groups with the brand in the name and no review; no judgement implied
Latest CT observation
—
log timestamp, not issuance or collection time
No matching certificate names for these filters.Collection does not cover every public log from its beginning, so this is not a complete inventory and not a safety verdict.

Collected from public certificate-transparency logs since 2026-10-18; 52,616 log entries checked so far. Cloudflare Nimbus2026, Google Argon2026h2, Google Xenon2026h2 are sampled at the newest entries, so their coverage is partial. Times are CT log timestamps, which differ from certificate validity dates. Certificate counts include precertificates and final certificates as separate artifacts. The "Source-reported abuse" badge appears only when an independent source reported that exact name for this organization; a certificate name match never creates it, and "No report in sample coverage" is not a safety verdict. How CT works