sweeply[.]run

This domain, sweeply.run, presents a targeted phishing threat designed to impersonate YouTube's copyright enforcement system. Analysis of the page title, 'Yоutubе | Copyright strikes,' reveals an attempt to deceive content creators by mimicking official YouTube notifications regarding copyright violations. The use of homoglyphs in the title ('Yоutubе' with Cyrillic 'о') further indicates malicious intent to bypass user scrutiny and increase the likelihood of successful credential harvesting or malware delivery. Such tactics are commonly employed to exploit creators' urgency in resolving copyright claims, potentially leading to account compromise or financial fraud. Infrastructure analysis provides concrete indicators of malicious activity. The domain was registered on January 26, 2026, through NameCheap, Inc., a registrar frequently associated with newly created phishing domains. Despite its recent creation, sweeply.run has already been flagged on one security blocklist and appears in a single threat intelligence pulse on a major threat-sharing platform. Notably, the domain currently shows 0/95 detections on VirusTotal, suggesting it has evaded widespread automated detection thus far. It resolves to the IP address 188.114.96.3, which is linked to a content delivery network known for providing anonymity to malicious actors. The site employs Node.js, React, and Express, alongside Cloudflare and HTTP/3, indicating a modern, obfuscated infrastructure designed to resist takedowns and analysis. Users who have visited sweeply.run should take immediate remedial action to mitigate potential risks. If any credentials or personal information were entered on the site, affected accounts should be secured by changing passwords and enabling multi-factor authentication. System scans for malware are recommended, particularly if files were downloaded or browser interactions occurred. Given the domain's use of Cloudflare, traditional IP-based blocking may be ineffective; instead, users should rely on updated security blocklists and browser-based phishing protections. Content creators targeted by this campaign should verify any copyright claims directly through YouTube's official channels rather than trusting unsolicited notifications.