mediasync[.]sh

This domain is flagged as a high-risk credential theft operation impersonating YouTube to deceive users into surrendering account credentials. The fraudulent page mimics YouTube’s copyright strike notification system, a tactic designed to exploit creators’ fear of account termination. Analysis indicates the domain is engineered to harvest login details, which may subsequently be used for unauthorized access, content manipulation, or further phishing campaigns targeting linked accounts. Infrastructure analysis reveals the domain was registered on January 30, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to IP address 104.21.36.252, hosted on Cloudflare’s network (AS13335), which is commonly used to obfuscate the true origin of phishing infrastructure. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Detection metrics show 22 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing and at least one additional security blocklist have classified it as phishing. The domain remains active and unmitigated at the time of this report. To mitigate risks associated with this credential theft campaign, network administrators should implement DNS-level blocking for mediasync.sh and its resolving IP. End users should be advised to verify the legitimacy of any copyright-related notifications by accessing YouTube’s official platform directly, rather than following embedded links. Multi-factor authentication (MFA) should be enforced on all accounts to reduce the impact of credential compromise. Organizations are further advised to monitor for unauthorized access attempts originating from this domain or associated IP ranges, particularly in environments where YouTube accounts are used for business purposes.