launch-cast[.]live

The domain launch-cast.live was registered on February 28, 2026 through NiceNIC International Group Co., Limited and is presently taken offline, returning an HTTP 404 status. DNS resolution points to 142.250.217.142, an address announced by AS13335 Cloudflare, Inc. in the United States. The domain serves a TLS certificate issued by Let’s Encrypt (E7), and its authoritative name servers are kiki.ns.cloudflare.com and randall.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS and edge services. Content‑delivery metadata reports the presence of YouTube‑related technology, HTTP Strict Transport Security (HSTS), and HTTP/3, while the page title returned by the server is “YouTube”.

These indicators collectively suggest an attempt to impersonate the YouTube brand, consistent with the classified scam type of brand impersonation. Reputation data shows a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the site, and two of ninety‑three VirusTotal scanners flagged the domain as malicious.

The limited detection footprint and the offline status leave the current payload or phishing page content unverified, so the exact malicious functionality remains uncertain. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the listed Cloudflare name servers, and consider adding the IP address 142.250.217.142 to threat‑intel feeds. Ongoing observation of any re‑hosting attempts or certificate renewal is recommended, as the infrastructure components (Cloudflare CDN, Let’s Encrypt certificate) are readily reusable for future campaigns targeting the YouTube brand.