How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate

A Fake Copyright Strike Was Close to the Perfect Lure for a Creator

Nothing gets a working creator's attention faster than a copyright claim. A strike can demonetize a video, pull it down, or close a channel that took years to build, and the window to respond always feels short. A notice that says your channel is under review gets opened right away, and one phishing operation built its entire business on that reaction.

ZeroFox Disruption and Signals Labs identified an estate of 110 domain names running a single phishing kit that impersonated copyright enforcement, validated what it was doing, and shared the findings with partners positioned to act on them. Most of that infrastructure is now down.

Of the 110 names, 82 have been suspended by registrars and registries, and none of the remaining 28 still serves the lure. To get there, we treated the estate as one single operation, confirming pages that automated scanners had scored as completely clean, and putting the evidence in front of the partners who could each pull a piece.

What follows is what the estate was, how it worked, and how it came apart.

The lure reaches creators as a copyright strike or a DMCA takedown notice, referring to the Digital Millennium Copyright Act, the US law platforms use to handle copyright complaints. Following the link brought a creator to a page titled “YouTube Copyright Strikes — Channel Status Check” that appeared to walk them through a review of their account.

The page had no interest in their videos. Every element on it existed to get them to sign in to Google, because the account was what the operator was after.

The Google Sign-In Window Was Painted Inside the Page

The credential step used a browser-in-the-browser attack. Rather than sending the victim to a look-alike domain, the kit drew a fake Google sign-in window inside the page it already controlled, complete with a title bar, a spoofed address bar reading accounts.google[.]com, and a padlock. The window was nothing but HTML and CSS, yet it could be dragged, it resembled the popup Google actually shows, and the usual advice to check the address bar failed against it, because the address bar being checked was a picture.

The kit then collected the Google email address, the password, the session cookie, and the second factor. That last item is what made it dangerous, because capturing a one-time code or a session token in real time means multi-factor authentication does not stop the attack, and the operator walks away with the account rather than a password that might not work. For a creator, the account and the channel are the same thing.

The documented end state for this class of attack is a hijacked channel renamed and repurposed for cryptocurrency-scam livestreams, which is why creator accounts with real subscriber counts are worth the effort.

Automated Scanners Scored These Pages Clean, and They Were Wrong

Every live member we checked came back not malicious with a score of zero and no brand detection from automated URL reputation tooling. Those are false negatives, and a security team that triages on the engine verdict alone will close the ticket.

The pages cloaked, so a scanner, or anyone arriving without a valid per-victim token in the link, got a harmless shell: a generic account-status page, or a decoy titled “Maintenance Underway — Our Website” or “Northwind Studio — Independent design & engineering.” The fake Google window rendered only for a visitor carrying the right token, meaning the victim who clicked the link in the original notice. The brand imagery was drawn in a way that content-based classifiers did not catch either.

We called this malicious on what the page did, the cloaking behavior, and the kit structure shared across the estate. The pages also pulled in scripts named console-ban and context-menu-ban, which block the developer console and right-click inspection, so the kit was actively discouraging exactly the person who would look closer. None of that shows up in a reputation score.

One Kit, 110 Domains, and a Naming System You Can Hunt

The 110 names were registered between November 2025 and late September 2026, and they ran the same kit. What made the estate tractable, and what makes the next one findable, is that the operator named things in readable families:

• dmca-* and *-dmca, including dmca-check, dmca-verify, dmca-report, and check-dmca
• strike*, including strikeverify, strike-check, and dmcastrike
• takedown-*, including takedown-help, takedown-alert, and takedown-notification
• account-status names such as ytchannelstatus and ytchannelalerts
• two recurring words that carry no brand at all, mediasync (with mediaforsync, creatorsmediasync, and mediasyncdigital) and sweep / sweeply
• an id-number and payment cluster, with names like id0976443 and paymentid2010030108, used for the tokenized victim links

Those last two families are the useful ones for hunting, because mediasync and sweeply look like internal naming rather than anything a victim would ever read, which suggests the operator's own inventory.

Registration concentrated on a short list of low-cost registrars, with NiceNIC International sponsoring 52 of the 110 names and the rest spread across Namecheap, Global Domain Group, Dynadot, PDR, CNOBIN, Dominet HK, and Hello Internet. The top-level domains were the cheap and disposable end of the market: .info, .cfd, .click, .sbs, .ink, and .shop. Victim links also arrived on random two-character subdomains, as in 4x.dmca-strike[.]com and ye.dmca-desk[.]com.

The kit was not loyal to one brand. The same structure showed up on a PayPal-themed page and on a Russian-language casino login page, so the credential capture is reusable and creator account takeover was simply where this operator pointed it most.

Behind Cloudflare, Two Russian Origins Tied the Estate Together

Every live front-end sat behind Cloudflare, which hid where the pages were actually served from. Looking at historical resolution data for those names surfaced the hosts behind the proxy, and two of them were shared across the estate and based in Russia.

The first, 103.101.85[.]19, was the more useful one. It co-hosted confirmed estate members alongside the mediasync cluster and the id-number names, which tied that subset of the estate together below the Cloudflare layer and was a stronger link than a shared registrar or a shared kit. The range is registered to a Russian sole proprietor and leased through an address broker, and it ran Linux with nginx 1.18.0 on ports 22, 80, 443, and 8080. The second, 5.101.84[.]233, sat at Petersburg Internet Network and hosted one estate member next to Russian movie-piracy sites.

The operator is Russian-speaking at moderate-to-high confidence. The hosting is one part of that, and the kit itself is the other, carrying hard-coded Russian interface strings and page titles that use Cyrillic characters shaped like Latin ones.

Sharing the Findings Took the Estate Apart

Once we had the full picture, we passed the domains, the origins, and the kit fingerprints to partners in a position to act on them. We are not naming them here, but the results show up in the infrastructure.

Of the 110 names, 82 no longer resolve, and the registration records show suspension rather than expiry, with registrars and registries applying client hold or server hold. We re-checked a sample and those holds are still in place.

The 28 names that still resolve are mostly hollow. Seventeen return a 523 from Cloudflare, which means the proxy still answers for the name but can no longer reach the origin behind it. Six more now serve Cloudflare's own “Suspected Phishing” interstitial, so the service that was unwittingly fronting the operation warns people away from it instead. The Blogger-hosted page, which was interesting precisely because free hosting sidesteps registrar suspension, returns “Blog not found.”

At the time of writing, none of the 28 are serving the lure any more. The last one stopped reaching a working origin in early November, and that name is not under registrar hold, so the operator still controls it and could point it at new hosting at any time. That is the piece we are still watching.

This is what disruption usually looks like from the inside. It is rarely one decisive action, and more often a lot of separate parties each pulling the piece they control, which is why sharing the whole picture matters more than sitting on it.

The Operator Will Probably Rebuild

The campaign itself is probably not finished. The estate went up over eleven months at a steady pace, mostly on registrars and top-level domains where a replacement name costs a few dollars, and an operator who loses this much infrastructure generally re-registers rather than retires. No new names have appeared in our data since early October, which is the kind of quiet that usually precedes the next batch.

The naming system is the reason that rebuild is worth watching rather than dreading. Operators change domains easily and change habits slowly, and this one leaves fingerprints in how it names things.

What Creators and Security Teams Should Take From This

For anyone who manages creator or brand accounts, the practical defense is a routing rule rather than a detection one. Copyright strikes and channel status live inside the platform, so a notice that asks you to sign in somewhere else to resolve a strike is worth treating as hostile on that basis alone, before anyone studies the page. Opening the platform directly in a new tab costs nothing and defeats the entire flow, because the fake sign-in window only works when the victim never leaves the attacker's page. Phishing-resistant authentication such as a hardware security key or a passkey helps here in a way that one-time codes do not, since a code typed into a painted window is captured in real time.

For security teams, three things from this estate outlast it. The naming families are hunting material, and mediasync, sweeply, and the id-number and payment clusters are worth watching because they are the operator's internal vocabulary rather than anything shaped for a victim. A reputation score of zero on a page like this should not close a ticket, since cloaked pages are built to show scanners something clean. And when an estate hides behind a proxy, historical resolution data is what reveals the shared origin underneath, which is where the real grouping shows up.

If you protect creator accounts or a brand that creators work with, the naming families are the part to load into hunting now. The domains that carried this campaign are mostly gone, and the habits that produced them are not.

How ZeroFox Discovers, Validates, and Disrupts Estates Like This One

Everything described above maps to work the ZeroFox platform does continuously. Domain and Phishing Protection combines proprietary domain and URL sourcing, anti-cloaking browsers, AI-powered detection, continuous domain monitoring, and disruption and takedown orchestration, and the anti-cloaking piece matters directly here, because cloaked pages are the reason automated tooling kept scoring these domains clean.

ZeroFox analyzes 100M+ domains and URLs daily and sources 6B+ domains and URLs annually, which is how a set of names scattered across eight registrars and a dozen disposable top-level domains surfaces as one estate instead of 110 unrelated alerts.

Disruption is the other half, and it is why findings like these do not sit in a report. ZeroFox works with 180+ Global Disruption Network partners spanning ISPs, DNS operators, registrars, social platforms, and browsers, carries out 1M+ successful takedowns annually at a 95%+ takedown acceptance rate, and averages 10 min to mitigate a phishing URL. The OnWatch Managed Services team and the Takedown-as-a-Service team work 24/7/365, so the sharing and follow-through that pulled this estate apart is a standing process rather than a one-time effort.