Six-Month Review Finds C2 Fingerprints Outlast YouTube DMCA Phishing Indicators
Summary
A six-month review found IP, CSS and favicon pivots from a YouTube DMCA phishing campaign quickly went stale, while C2 banner/header hashes and newer title-tag and redirect patterns exposed related infrastructure.
Key points
- IP, CSS-class and favicon pivots from the November 2025 campaign produced little new activity over time.
- C2 banner and response-header hashes continued to reveal new infrastructure during the six-month review.
- A title-tag pivot from dmca-notification[.]info matched hundreds of domains observed between February and May 2026; only the original domain was publicly flagged as malicious in Validin.
- The credential-harvesting domain blacklivesmattergood4[.]com redirected to /youtube/main/; searching for that pattern identified nearly 100 other domains.
- The April 2026 campaign used a personalized fake Google login with a Browser-in-the-Browser technique, unlike the earlier campaign's malware-download lure.
- The authors demonstrate using historical DNS, response fingerprints, title tags and redirect patterns to expand point-in-time indicators into potentially related infrastructure.
Article Details
- Attack Vectors
- Fake YouTube DMCA copyright notices lured creators to malicious sites.
- A later campaign used a personalized fake Google login with a Browser-in-the-Browser presentation.
- A credential-harvesting domain redirected visitors to /youtube/main/.
- Defensive Notes
- The article reports that historical IP and simple class or favicon hash pivots quickly became stale; C2 banner and header fingerprints continued to surface related infrastructure.
- Use historical DNS, response-header fingerprints, title tags, and redirect patterns as complementary pivots when investigating related domains.
- Treat domains discovered through shared fingerprints as related leads: the article notes that only the original domain in the title-tag cluster had a public malicious flag in Validin.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | alphazero1-endscape[.]cc | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | blacklivesmattergood4[.]com | Domain reported as a credential-harvesting endpoint; the phishing lure communicated with it. |
| DOMAIN | dmca-notification[.]info | Domain reported as the primary phishing site in the newer YouTube DMCA campaign. |
| DOMAIN | dmca-takedown[.]info | Named as an example of a domain related to the YouTube DMCA phishing infrastructure. |
| DOMAIN | domain-monitoring[.]cc | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | fileless-storage-s3[.]cc | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | handle-me-sv1[.]com | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | hardware-office[.]cc | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | health-smooth-eu3[.]com | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | holiday-updateservice[.]com | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | memory-protection-layer1[.]cc | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | memory-protection-layer2[.]cc | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | my-smart-house1[.]com | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | vvork-space[.]com | Domain surfaced through response-header fingerprinting associated with C2 domains. |
| DOMAIN | youtube-dmca[.]cfd | Named as an example of a domain related to the YouTube DMCA phishing infrastructure. |
| IPV4 | 101[.]99[.]89[.]94 | Historical DNS pivot associated with infrastructure from the earlier reported phishing campaign. |
| IPV4 | 101[.]99[.]92[.]246 | Historical DNS pivot associated with infrastructure from the earlier reported phishing campaign. |
| IPV4 | 176[.]46[.]152[.]11 | IP address reported to have responded with the banner hash associated with C2 infrastructure. |
| IPV4 | 193[.]23[.]199[.]125 | IP address reported to have responded with the banner hash associated with C2 infrastructure. |
| IPV4 | 45[.]156[.]87[.]34 | IP address reported to have responded with the banner hash associated with C2 infrastructure. |
| IPV4 | 46[.]151[.]182[.]8 | IP address reported to have responded with the banner hash associated with C2 infrastructure. |
| IPV4 | 5[.]188[.]190[.]160 | IP address reported to have responded with the banner hash associated with C2 infrastructure. |
| MD5 | 5dab1fa5f7d42e5eca2385ce3dad1f03 | Banner fingerprint associated with IP addresses used for C2 in the original malware analysis. |
MITRE ATT&CK
T1036 · MasqueradingThe phishing pages impersonated YouTube copyright notices and a Google login workflow.T1056.003 · Web Portal CaptureThe fake login and credential-harvesting domain were used to collect credentials.T1566.002 · Spearphishing LinkThe campaign used fake YouTube DMCA notices and malicious sites to lure creators.
People
John HammondPublicly reported the earlier YouTube DMCA scam and provided a breakdown of its lure, malware, and related infrastructure.Scott ManleyPublicly reported the earlier YouTube DMCA scam and provided a breakdown of its lure, malware, and related infrastructure.TannerUsed historical DNS to pivot on A-record history and identify domains in the earlier investigation.
Products
GoogleThe April 2026 Malwarebytes campaign used a different phishing flow, including a fake Google login built with a Browser-in-the-Browser technique.ValidinThe phishing site dmca-notification[.]info produced a title-tag fingerprint that matched hundreds of related domains in Validin.YouTubeThis article revisits a fake YouTube DMCA phishing campaign, showing that older IP, favicon, and CSS-hash pivots quickly went stale while C2 banner and header fingerprints kept revealing new infrastructure.