sweep-cooperation[.]info

Analysis of sweep-cooperation.info indicates an active phishing domain targeting users with a fraudulent YouTube copyright strike notification. The domain was registered on January 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 104.21.20.171, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (grant.ns.cloudflare.com and nadia.ns.cloudflare.com) and technologies including Node.js, React, Express, and HTTP/3, suggesting a modern, potentially obfuscated phishing framework. The page title, 'Yоutubе | Copyright strikes,' explicitly mimics a legitimate YouTube enforcement notice, a common social engineering tactic to induce urgency and compliance. Google Safe Browsing has flagged the domain under the 'SOCIAL_ENGINEERING' category, and it appears on at least one security blocklist, including PhishDestroy. As of July 12, 2026, the domain remains active, returning an HTTP 302 redirect, which may be used to obscure the final phishing destination or evade automated crawlers. Detection data from VirusTotal shows 18 of 91 security vendors flagging the domain, though the specific nature of these detections (e.g., phishing, malware, or generic malicious) is not disclosed. The domain has also been documented in one threat intelligence pulse on AlienVault OTX, indicating limited but confirmed visibility in security communities. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate maliciousness but is consistent with modern phishing infrastructure leveraging legitimate certificate authorities. Defenders should treat this domain as high-risk due to its active status, explicit targeting of a widely recognized brand, and use of Cloudflare to mask hosting details. Network-level blocking of 104.21.20.171 and the domain itself is recommended, along with monitoring for related infrastructure (e.g.