sweep-cooperation[.]world

sweep-cooperation.world is a high-risk phishing domain that specifically targets YouTube content creators with a fake copyright strike notification, aiming to steal their login credentials. The page title, "Yоutubе | Copyright strikes," uses a homoglyph attack (replacing Latin letters with Cyrillic) to appear legitimate. This is a classic credential theft scheme designed to trick victims into entering their Google account credentials on a fraudulent page.

Technical analysis reveals multiple red flags. The domain was registered on January 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains. It resolves to IP 104.21.25.117 and uses an SSL certificate from Google Trust Services (WE1), which may lend false legitimacy. VirusTotal reports that 19 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. AlienVault OTX has recorded it in one threat intelligence pulse. Google Safe Browsing also flags it as phishing. The domain is currently offline, but similar threats may reappear under different names.

Users who encounter this domain should never enter any credentials or personal information. Since this is a credential theft campaign, affected individuals should immediately change their YouTube and Google account passwords, enable two-factor authentication, and review recent account activity for unauthorized access. Organizations should block the domain at the network level and educate users about phishing tactics that exploit urgency, such as fake copyright strikes. Regular monitoring of blocklists and threat intelligence feeds is recommended to catch related domains early.