Creator Lockdown Free sponsor checklist

Campaign tracker · Fake sponsorships

MATCHY, SCOUTY and TUBIVE: how the fake “Hollyland” sponsorship scam steals YouTube channels

Last updated . We update this page when new names or domains are reported.

If you got a polite, well-written email from a “Creator Partnerships” team at Hollyland, Nike, Spotify or Maono, and it mentioned your actual videos, read this before you sign in anywhere.

I test the security of web apps, mobile apps and internet-facing systems for a living, with permission. Login pages are what I look at most. This campaign isn’t technically clever. It’s good because every step looks like a real brand deal. Here’s how it works, why each step fools smart people, and the setup that defeats this version.

What was reported, and by whom

On 7 October 2026, ESET researcher Christian Ali Bravo published “Inside a brand deal scam targeting YouTube creators” on WeLiveSecurity. The next day, Help Net Security’s Zeljka Zorz covered it as “YouTubers targeted with fake sponsorships and ‘channel verification’ phishing”, adding other reported names and brands. The facts below come from those two articles. My own analysis as a tester is labelled.

The attack, step by step (and why each step works)

1. A personal email with no link in it

The first message is a “Paid collaboration opportunity”. In ESET’s example it came from a sender who introduced herself simply as “Brandi” from Hollyland’s Creator Partnerships team, offering a device and a long-term collaboration. It refers to the creator’s own videos.

Why it works (my analysis)Quoting your videos costs the attacker nothing, because your channel is public, and it buys your trust. In ESET’s account, the platform link only arrived after the creator replied with rates. That matters: an email with no link gives a spam filter, link scanner or AI checker nothing to flag. The dangerous part comes in the second email, once you’ve decided this is a real conversation.

2. You negotiate, then get sent to a “platform”

Once you reply with your rates, the “brand” sends you to its collaboration platform to verify channel statistics, the agreement and payment. ESET names one example address as joinmatchy[.]com/hollyland.

Why it worksReal influencer marketplaces exist, so being “moved to the platform” feels normal. And having already named a price, you’re invested.

3. A polished dashboard built from your own data

According to ESET and Help Net Security, the site shows campaign metrics, brand logos, an earnings calculator, and tools for contracts and payments. It asks for your channel URL and pulls your public channel data so the page looks tailored to you.

Why it worksWe treat polish as proof. It isn’t: a convincing dashboard is an afternoon’s work with templates. Help Net Security notes the platforms share functionality, favicons, meta descriptions and parts of their source code, with only the branding changed per target. It’s a kit, reskinned for each brand.

4. “Sign in with Google to verify your channel”

Then comes the step that matters. You’re sent to a Google sign-in page, supposedly “to verify their ownership of the YouTube channel” (ESET). ESET points out why this is persuasive: “Sign in with Google” is a real, common feature, so the request doesn’t feel strange.

ESET’s description of the result is blunt: the fake page “captures the password and one-time code”, and with them, the account.

Why it works (my analysis)A one-time code proves you have your phone right now. It doesn’t prove which website you’re typing it into. If a fake page passes your password and code to Google within seconds, Google sees both as correct. That’s real-time phishing, and it’s why SMS and authenticator-app codes don’t stop it.

5. They lock the door behind them

Help Net Security reports that one creator found the intruders had replaced her phone number and recovery email, and generated new backup codes, “all to make it harder for her to get back in.” ESET’s list of consequences includes access to linked Google services such as Gmail and Drive, impersonating the creator to contact followers or collaborators, and using the channel to spread malicious links.

Names and domains reported so far

Do not visit these

Domains are written with [.] on purpose and are not links.

NameDomain(s) reportedBrands impersonated or claimedSource
MATCHYjoinmatchy[.]com, matchyjoin[.]comHollyland (main example); near-identical variants for Nike and SpotifyESET; Help Net Security
SCOUTYjoinscouty[.]com, and other domains containing “Scouty”Same schemeESET; Help Net Security
TUBIVEmytubive[.]comNamed in “other recent reported scam attempts”Help Net Security
Creoventura (“agency”)creoventura[.]comListed AndaSeat among “brands we work with”. AndaSeat said: “Creoventura is NOT affiliated with AndaSeat in any way.”Help Net Security

Help Net Security also found that Creoventura’s name doesn’t quite match its UK company register entry, and that its domain was registered in August 2026, through Namecheap, for one year. You can check both things yourself next time.

ESET says the names and domains “changed repeatedly between June and August”, and Help Net Security that they “are changed regularly.” So there may already be new names. This table is not a complete list, and a platform missing from it proves nothing. Learn the pattern instead.

The red flags you can check in five minutes

No security tools needed, just five minutes and some suspicion.

  1. Compare the sender’s domain with the brand’s real website. In this campaign it had no connection to the brand (both sources). In Gmail on a computer, open the message, click the three-dot More menu next to Reply, and choose Show original (Google’s instructions). If the “From” or “Reply-To” domain isn’t the brand’s, that’s a red flag.
  2. Notice when the link shows up. A link-free first email, then a platform link after you share rates, is this campaign’s shape.
  3. Any request to sign in to “verify” your channel is a hard stop. ESET’s rule of thumb: “a site that only needs to verify your channel has no reason to manage it.” Your stats are public. A brand doesn’t need your password to see them.
  4. Look at the address bar, not the logo. As ESET warns, “a bogus page can look identical to the real one.” My habit as a tester: never sign in from an email link. Open the service yourself.
  5. Check the domain’s age. Free WHOIS/RDAP lookups show when a domain was registered. A “global agency” on a months-old, one-year domain deserves suspicion.
  6. Check the company on the official register of the country it claims. A name mismatch, or an unrelated registered activity, were both flags in the Creoventura case.
  7. Files you must download. Not part of this campaign, but an older lure: Malwarebytes documented fake Opera GX sponsorships in 2022 pushing a suspicious download.

What does not prove anything: professional design, your own video titles, a real-sounding name, a famous logo. And finding no flags doesn’t make an email real. It means you haven’t found one yet. The only reliable step is the next one.

How to verify a sponsorship the safe way

YouTube’s own channel security tips say: “Before replying to a brand deal or sponsorship email, it’s best to verify legitimacy by calling the company at a publicly listed number found on trusted platforms or contacting the person that you usually work with.”

In practice:

The setting that beats this version: a passkey, with the old routes closed

Passwords and SMS or app codes can all be typed into a fake page, so on their own they don’t stop step 4.

A passkey is different: it signs you in with your device’s unlock (fingerprint, face or PIN), so there’s nothing to type. Google says this makes passkeys “more secure against phishing” (Google Account Help), and YouTube’s security tips recommend one.

The catch most guides skip. On the same Google page: creating a passkey “doesn’t change or remove any authentication or recovery factors currently on your account”, and “you still have the option to use your password to sign in to your account.” So with a passkey added and nothing else changed, the MATCHY page can still ask for your password and code, and they still work. This isn’t theoretical. One creator who lost an account to a different fake-sponsor lure (BrandSnob.AI) wrote that the attackers “deleted my passkeys”.

What actually closes the route is three things together:

  1. Add the passkey (or two hardware security keys) at myaccount.google.com/signinoptions/passkeys. Type the address yourself.
  2. Shut the password-and-code route. The Google setting I can point to that does this is Advanced Protection, which “requires you to use a passkey or a security key” to sign in. It’s built for people with “high visibility”, which a monetised creator is. Read Google’s page first, and set up a backup key before you enrol.
  3. Clean out what’s already there. In Security Checkup, sign out devices you don’t recognise, remove unknown third-party access, and check your recovery phone, recovery email and backup codes. Attackers who can’t phish the front door look for these side doors.

One more caveat from a tester: a passkey protects your login, not a consent screen. If you click “Allow” for an unknown app that wants to manage your YouTube account, no sign-in method can help. Close those screens.

If you already signed in

Act now, and only through official routes:

  1. Don’t go back to the site. ESET: “Above all, don’t return to the suspicious site to enter your credentials or authorize further access.”
  2. If you can still sign in, run Google’s Security Checkup at myaccount.google.com/security-checkup. Remove devices, recovery details, backup codes and third-party connections you don’t recognise. Change your password and turn on two-step verification.
  3. If you’re locked out, use Google’s official recovery at accounts.google.com/signin/recovery, then follow YouTube’s Recover a hacked YouTube channel guide.
  4. Be wary of anyone offering paid “channel recovery”. Recovery runs through Google and YouTube.

We don’t do recovery, and we’ll never ask for your login. Once you’re back in, the lockdown steps below are for you.

Check the next one before you reply

  • 30-second Sponsor X-Ray checklist (free, no signup). Tick what’s true about the email and see the red flags. It will never tell you an email is safe, because no checklist or tool honestly can. A paste-the-email version is coming, and Campaign Alerts subscribers get it first.
  • Campaign Alerts (free). One short email when a new fake-sponsor campaign starts hitting creators: names, domains and what it looks like.
  • The Lockdown Pack for YouTube. A one-afternoon, step-by-step setup for passkeys or security keys with the fallback routes closed, editor access, session clean-out, and a proof-of-ownership file you fill in before you ever need it. Written by a penetration tester. One price (€29 founding pre-order, €39 list; + VAT for EU/UK buyers), no install, and we never touch your account. Pre-orders open soon: get notified.
Take the sponsorship. Keep the channel. Start here →

FAQ

Is every Hollyland, Nike, Spotify or Maono sponsorship email fake?
No. These are real companies whose names were used by scammers. Some outreach under their names may be genuine. The point is that you can’t tell from the email. Verify through the brand’s own website before you sign in anywhere.
I got one of these emails but didn’t click. What now?
Don’t reply to ask if it’s real. If you want the deal, contact the brand through its own website. Report the email as phishing in Gmail. Then add a passkey and close the password-and-code route next to it (see above). A passkey on its own isn’t enough.

Sources

Quotes re-checked against the sources on 9 November 2026.