mediasync[.]cv

This domain, mediasync.cv, poses as YouTube's copyright strike verification portal to harvest user credentials. The page displays a fraudulent 'Yоutubе | Copyright strikes' interface, designed to trick content creators into entering their account details under threat of channel termination. Analysis indicates this is a targeted credential theft operation, likely aiming to compromise YouTube accounts for subsequent abuse in scams or malware distribution. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on January 26, 2026 through NAMECHEAP INC, with an anomalous future creation date suggesting domain age manipulation. VirusTotal detection shows 24 out of 95 security vendors flagging this domain, while it appears on one security blocklist and is explicitly categorized as phishing by Google Safe Browsing. The domain resolves to 172.67.211.104 (AS13335 Cloudflare, Inc.) and operates without SSL certification, further reducing trust indicators. Users who visited mediasync.cv should immediately revoke any entered credentials through YouTube's account recovery portal. Enable two-factor authentication on all Google accounts and monitor for unauthorized activity. Security teams should block the domain and IP 172.67.211.104 at network perimeter controls. The domain's active status and lack of SSL certificate make it particularly dangerous for users with disabled security warnings or those accessing from unmanaged devices.