# 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting

> ZeroFox disrupted a 110-domain phishing estate running a single kit that impersonated DMCA/YouTube copyright-strike notices to hijack content creators' Google accounts. The kit draws a fake browser-in-the-browser Google sign-in window, captures email, password, session cookie and second factor in real time, and cloaks itself behind per-victim tokens. ZeroFox assesses the operator as Russian-speaking with moderate-to-high confidence.

- **Published:** 2026-11-10T20:07:21Z
- **Last reviewed:** 2026-11-10T20:07:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5676
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5676.png
- **ID:** TL-2026-5676
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

ZeroFox (Carlos Alvarez, published 2026-11-10) documents an estate of 110 domains, registered from November 2025 to late September 2026, that all served one phishing kit. Victims receive a fake copyright strike or DMCA takedown notice, which ZeroFox calls close to the perfect lure for a creator. The tokenized link leads to a page titled "YouTube Copyright Strikes - Channel Status Check" that exists only to push the victim to sign in to Google.

The sign-in is a browser-in-the-browser (BitB) window drawn with HTML and CSS inside the page: a draggable fake popup with a title bar, a spoofed address bar showing accounts.google.com, and a padlock icon. Because the address bar is a graphic, URL-checking advice does not protect the victim. The kit captures the email address, password, session cookie and second factor in real time, so one-time-code MFA does not stop it. The documented end state is a hijacked channel that is renamed and used for cryptocurrency-scam livestreams.

The kit cloaks aggressively. Scanners and visitors without a valid per-victim token get a benign page (a generic account-status page, "Maintenance Underway", or a fake "Northwind Studio - Independent design & engineering" site). The fake Google window renders only for the victim who clicked the tokenized link. Brand imagery is drawn so content-based classifiers do not flag it, and the scripts console-ban and context-menu-ban block the developer console and right-click inspection. URL reputation tools returned a score of zero with no brand detection, which ZeroFox describes as false negatives.

Infrastructure: Cloudflare fronts all live front-ends. Origin 103.101.85.19 (Russian-registered range leased through an address broker, Linux, nginx 1.18.0, ports 22/80/443/8080) co-hosted confirmed estate members, the mediasync cluster and the ID-number names. Origin 5.101.84.233 (Petersburg Internet Network) hosted one estate member alongside Russian movie-piracy sites. NiceNIC International sponsored 52 of the 110 names; other registrars were Namecheap, Global Domain Group, Dynadot, PDR, CNOBIN, Dominet HK and Hello Internet. TLDs include .info, .cfd, .click, .sbs, .ink and .shop. Victim links use random two-character subdomain labels (for example 4x.dmca-strike.com and ye.dmca-desk.com).

Status at publication: 82 domains suspended by registrars or registries, 17 return Cloudflare HTTP 523, 6 show Cloudflare's Suspected Phishing interstitial, 1 Blogger-hosted page returns Blog not found, and 1 name stopped reaching a working origin in early November without a registrar hold, so the operator may still control it. None of the 28 remaining names serve the lure. No new names were seen after early October 2026. The same kit structure was also seen on a PayPal-themed page and a Russian-language casino login page, so the credential capture is reusable.

Attribution: ZeroFox assesses a Russian-speaking operator at moderate-to-high confidence, based on hosting in Russian ranges, hard-coded Russian interface strings, and page titles using Cyrillic characters that resemble Latin letters. The ZeroFox article does not name the exfiltration channel or a collection endpoint and publishes no file hashes or URL paths. Related but separately documented copyright-strike BitB kits (Malwarebytes, 2026-04-15; urlscan.io GSVerify/Knock, 2026-08-17) share the lure and technique and also show Russian-language artifacts, but ZeroFox does not link its estate to them, so their indicators are not included here.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1036 Masquerading
- T1480 Execution Guardrails
- T1056.003 Web Portal Capture
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1090 Proxy
- T1078.004 Cloud Accounts
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake Copyright-Strike BitB Phishing Estate - Lure Domain Family / Origin Access (Web Proxy)** (`TL-2026-5676-SPL-001`)

Detects web-proxy requests to the 110-domain fake DMCA/YouTube copyright-strike phishing estate documented by ZeroFox (TL-2026-5676): known victim-link parents dmca-strike.com and dmca-desk.com, the dmca-*/strike*/takedown-*/ytchannel*/mediasync name families, and connections to the Cloudflare-bypassing origins 103.101.85.19 and 5.101.84.233. A hit means a user clicked a tokenized link that leads to the browser-in-the-browser Google sign-in page that captures password, session cookie and second factor in real time. Because the kit cloaks behind per-victim tokens and scores zero on URL-reputation tools, name-pattern and origin-IP matching is the reliable signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1583.001, T1656
- **Data sources:** zscaler:nss:web (index=proxy), CommonSecurityLog (web proxy), Sigma logsource category: proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="zscaler:nss:web" earliest=-24h
| rex field=url "^(?:https?://)?(?<lure_host>[^/:?#]+)"
| eval lure_host=lower(lure_host), dest_ip=coalesce(dest_ip,"")
| eval ioc_domain=if(match(lure_host,"(^|[.])(dmca-strike|dmca-desk)[.]com$"),1,0)
| eval ioc_origin=if(match(dest_ip,"^(103[.]101[.]85[.]19|5[.]101[.]84[.]233)$"),1,0)
| eval family_hit=if(match(lure_host,"dmca-|-dmca|dmcastrike|strike-?verify|strike-check|takedown-(help|alert|notification)|ytchannel(status|alerts)|mediaforsync|creatorsmediasync|mediasyncdigital"),1,0)
| where ioc_domain=1 OR ioc_origin=1 OR family_hit=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(lure_host) as lure_hosts values(dest_ip) as dest_ips sum(ioc_domain) as ioc_domain_hits sum(ioc_origin) as ioc_origin_hits by user src_ip
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lure_family = @'dmca-|-dmca|dmcastrike|strike-?verify|strike-check|takedown-(help|alert|notification)|ytchannel(status|alerts)|mediaforsync|creatorsmediasync|mediasyncdigital';
let origin_ips = dynamic(['103.101.85.19','5.101.84.233']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL) or isnotempty(DestinationHostName)
| extend LureHost = tolower(iff(isnotempty(DestinationHostName), DestinationHostName, tostring(parse_url(RequestURL).Host)))
| where LureHost matches regex @'(^|[.])(dmca-strike|dmca-desk)[.]com$'
    or DestinationIP in (origin_ips)
    or LureHost matches regex lure_family
| project TimeGenerated, SourceIP, SourceUserName, LureHost, DestinationIP, RequestURL, DeviceAction
```

### Sigma

```yaml
title: Fake Copyright-Strike BitB Phishing - Lure Domain Family Access (TL-2026-5676)
id: 7c1d3b52-4e8a-4f0b-9a63-2d5e8f1a6b01
status: experimental
description: Detects proxy requests to the fake DMCA/YouTube copyright-strike phishing estate (browser-in-the-browser Google credential harvesting) by known victim-link parent domains and the dmca-*, strike*, takedown-*, ytchannel* and mediasync name families.
references:
  - https://www.zerofox.com/blog/how-we-disrupted-a-110-domain-fake-copyright-strike-phishing-estate
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.resource-development
  - attack.t1583.001
logsource:
  category: proxy
detection:
  selection_ioc:
    cs-host|endswith:
      - '.dmca-strike.com'
      - '.dmca-desk.com'
      - 'dmca-strike.com'
      - 'dmca-desk.com'
  selection_family:
    cs-host|contains:
      - 'dmca-'
      - '-dmca'
      - 'dmcastrike'
      - 'strikeverify'
      - 'strike-verify'
      - 'strike-check'
      - 'takedown-help'
      - 'takedown-alert'
      - 'takedown-notification'
      - 'ytchannelstatus'
      - 'ytchannelalerts'
  condition: 1 of selection_*
falsepositives:
  - Legitimate copyright-compliance or DMCA-agent vendor sites visited by legal or trust-and-safety staff
  - Security researchers and phishing-triage analysts opening reported links
level: high
```

**Known false positives:**

- Legal / trust-and-safety staff visiting legitimate DMCA or copyright-agent vendor sites whose names contain dmca-
- Security analysts opening reported phishing links during triage
- Generic media-sync software vendors matching the mediasync stems

**Tuning notes:** Adjust index/sourcetype and the url/dest_ip field names to your proxy CIM mapping. Allow-list known DMCA vendors by exact registered domain. Do not close alerts on a clean URL-reputation score: the kit serves a benign decoy to scanners. Refresh the stem list from threat intel as new estate names appear (no new names seen after early October 2026).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Browser Process Connecting To Fake Copyright-Strike Phishing Estate (Endpoint) (locked: unlock with TL Creds)
- Google Workspace Account Login From Multiple IPs Within 30 Minutes (Session Cookie Theft / Account Takeover) (locked: unlock with TL Creds)
- Connections To Fake Copyright-Strike Phishing Origin Servers [indicator] and [indicator] (locked: unlock with TL Creds)
- Tokenized Two-Character Subdomain Lure Links On Copyright-Strike Phishing Domains (locked: unlock with TL Creds)
- Google Account Security Settings Changed After Phishing - Recovery / 2SV / Password Edit (locked: unlock with TL Creds)
- Phishing Kit Anti-Analysis Scripts [indicator] / [indicator] Loaded From Web Page (locked: unlock with TL Creds)
- Fake Copyright-Strike BitB Phishing - Credential Submission (HTTP POST) to Lure Estate (locked: unlock with TL Creds)
- Fake Copyright-Strike Phishing Estate - DNS Resolution of Lure Domain Families (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `103.101.85[.]19`
- Domain: `dmca-strike[.]com`
- IP address: `5.101.84[.]233`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate (ZeroFox, Carlos Alvarez)](https://www.zerofox.com/blog/how-we-disrupted-a-110-domain-fake-copyright-strike-phishing-estate)
- [Fake YouTube copyright notices can steal your Google login (Malwarebytes ThreatLabs)](https://www.malwarebytes.com/blog/threat-intel/2026/04/fake-youtube-copyright-notices-can-steal-your-google-login)
- [Influencer phishing: GSVerify and Knock clusters (urlscan.io Threat Research)](https://urlscan.io/blog/2026/08/17/InfluencerPhishing/)
- [YouTube DMCA Scam Emails: Fake Copyright Strikes That Steal Your Channel (MalwareTips)](https://malwaretips.com/blogs/?p=398556)
- [Extortionists target YouTubers in fraudulent copyright strike scam (MCV)](https://mcvuk.com/business-news/extortionists-target-youtubers-in-fraudulent-copyright-strike-scam/)
- [YouTubers Targeted with Phishing, Info-Stealing Malware (Bitdefender HotForSecurity)](https://www.bitdefender.com/blog/hotforsecurity/youtubers-targeted-with-phishing-info-stealing-malware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5676