takedown-alert[.]info

This domain, takedown-alert.info, is confirmed as a high-risk phishing site specializing in brand impersonation. Analysis indicates the threat actor designed the page to mimic YouTube's copyright strike notification system, targeting content creators with fraudulent takedown notices. The attack vector relies on social engineering to trick victims into entering credentials or downloading malicious payloads under the guise of resolving fabricated copyright violations. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 172.67.149.104 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 19, 2026, though this creation date may reflect registry manipulation. Detection metrics show 16 out of 95 security vendors on VirusTotal flagging the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The site appears on two security blocklists and is actively blocked by multiple DNS filtering services. Technologies detected include Node.js with Express framework and Cloudflare infrastructure, including HTTP/3 protocol support, which may be leveraged to evade traditional detection mechanisms. Mitigation requires immediate action from both network administrators and potential victims. Organizations should implement DNS-level blocking for takedown-alert.info and its associated IP address 172.67.149.104. Content creators should be trained to recognize that legitimate copyright strike notifications only appear through official YouTube Studio channels, never via third-party domains. All users who may have interacted with this domain should reset their credentials using multi-factor authentication and monitor their accounts for unauthorized activity. Given the domain's use of Cloudflare services, security teams should also investigate potential connections to other malicious infrastructure leveraging the same CDN provider.