youtube-droprix[.]top

PhishDestroy identifies youtube-droprix.top as an active YouTube-brand phishing domain designed to harvest Google account credentials. The site masquerades as a YouTube login portal, luring victims into entering email and password combinations that are immediately harvested by the underlying scam infrastructure. This domain is noteworthy for its extremely low detection on VirusTotal, with only 1 out of 95 security scanners currently flagging it—a sign it is still flying under the radar of many threat-intelligence platforms. It resolves to network address 85.137.55.62 and uses a legitimate Let’s Encrypt SSL certificate to appear genuine, which can mislead users into trusting the fake login page. Security researchers note that Let’s Encrypt certificates are often abused in the early stages of phishing campaigns to gain user trust before broader detection catches up. If you visited youtube-droprix.top or entered any credentials on the page, assume your Google account has been compromised. Immediately change your password and enable two-factor authentication on the official accounts.google.com page. Revoke any third-party app access you did not authorize and run a security check on your Google account. Report the domain to Google Safe Browsing and your IT administrator if this occurred on a managed device.