mass.report
Scan Intelligence Report0/100
critical Risk
complaints-dmca.report
https://complaints-dmca.report/
IP
172.67.149.83 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
5 days ⚠
HTTP
200 · 19.3s
SSL
Valid· E8, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: complaints-dmca.report
Scanned 2 times since Apr 12, 2026, 11:07 PM UTC
✗ Critical (100)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Vendors
30/30
Status
completed
✓ polyswarm✓ microsoft✓ brightcloud✓ bitdefender✓ sophos✓ apple✓ avg✓ eset✓ avast✓ emsisoft✓ apwg✓ netcraft✓ urlscan✓ isitphish✓ cisa✓ openphish✓ spamhaus✓ yandex✓ drweb✓ norton✓ urlabuse✓ fortiguard✓ urlquery✓ phishtank✓ phishreport✓ virustotal✓ kaspersky✓ mcafee✓ threatyeti✓ google
KB/IOK Matches (1)Apr 13, 2026, 03:43 AM UTC
youtube-dmca-kit
youtube-dmca-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
technology | ecommerce | finance | social_media | other · 4/15/2026
Summary
The page presents a DMCA takedown notice-style UI with branding that appears to imitate a YouTube/YouTube Studio style, but the domain Twitter is not an official YouTube domain. The page source shows a SPA-like structure with external scripts and a modal that mimics an abuse/verification flow. There is no direct evidence of credential harvesting on a known first-party brand, but the visual impersonation signals and the suspicious, newly-registered domain suggest a phishing page designed to coax users to take action or submit information.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸POST targets observed during capture: https://complaints-dmca.report/cdn-cgi/rum?.
▸Distinctive asset clues: index-C8qpshay.js, v8c78df7c7c0f484497ecbca7046644da1771523124516, index-DXyFcn8j.css, content-bg-DpSEef5n.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 11
Hosts: 2
Domains: 2
Suspicious Endpoints
hxxps://complaints-dmca[.]report/api/random-link
Observed Signals (3)
Impersonation of a known service (DMCA/takedown flow) via spoofed modal UISPA-like rendering with dynamic credential capture risk (static HTML contains no forms; forms may be loaded by JavaScript)Suspicious POST to /cdn-cgi/rum? and API endpoint calls that may be used for data exfiltration
Observed Indicators (1)
▸Open Graph/metadata references to suspicious og:url pointing to a different domain (https://dmca-strike.report/)
Risk AssessmentUsed in abuse reports
The domain is extremely new (5 days) and uses a free SSL cert from Let's Encrypt, which, combined with a visually impersonating DMCA takedown UI and dynamic content typical of SPAs, is a strong signal for credential-phishing abuse. The page loads scripts and makes POST requests (including to /cdn-cgi/rum?) that could be used for data exfiltration. The screenshot attached shows a modal UI resembling a legitimate DMCA flow, reinforcing impersonation risk. Given these signals, this site should be monitored and considered potentially harmful until further evidence clarifies legitimate use; the presence of an active WAF/Cloudflare block indicators is not confirmed here, but the SPA behavior and brand impersonation strongly suggest phishing risk.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API