mediasync[.]top

This domain, mediasync.top, is identified as a credential theft operation targeting users through brand impersonation of YouTube. The phishing page displays a fraudulent copyright strikes notification, designed to deceive content creators into entering account credentials under the pretense of resolving alleged violations. No cryptocurrency drainer kit signatures were detected in preliminary analysis, though the infrastructure aligns with credential harvesting tactics observed in similar campaigns. Infrastructure analysis reveals the domain was registered on January 12, 2026, through Namecheap Inc. and resolved to IP address 188.114.96.3, associated with Cloudflare, Inc. (AS13335). The domain currently lacks an SSL certificate and was flagged by Google Safe Browsing as phishing. Security vendor detections on VirusTotal reached 18 out of 95, while PhishDestroy and one additional blocklist have enforced restrictions. The page title, Yоutubе | Copyright strikes, contains subtle Unicode obfuscation (Cyrillic 'о' and 'е') to evade basic detection mechanisms. As of the latest assessment, mediasync.top has been taken offline, though residual risk persists due to the domain's recent registration and the potential for re-deployment. Users who interacted with the page are advised to immediately invalidate any entered credentials and enable multi-factor authentication on associated accounts. Organizations should monitor for similar Unicode-based domain spoofing and enforce strict validation of copyright-related communications. The absence of SSL further indicates a low-effort deployment, yet the Cloudflare hosting suggests an attempt to leverage reputable infrastructure for credibility.