What ytmp3.cc is today
Type ytmp3.cc into a browser today and you do not stay on ytmp3.cc. On 16 September 2026 the address answered with a single HTTP 301 redirect to convertytmp3.org, over HTTPS, plain HTTP and the www prefix alike. That day ytmp3.cc hosted no converter of its own: a signpost, not a destination.
The two names sit close together. Both resolved to the same IPv4 address, 88.80.22.66. A registry lookup the same day showed convertytmp3.org registered on 27 June 2026, under three months old, on the same three Njalla nameservers as ytmp3.cc. That is infrastructure overlap recorded by the registries, not evidence of common ownership, and Njalla exists to keep registrant details private.
Comparitech's removal guide for ytmp3.cc, published in October 2024 and last updated in July 2026, recorded the same move independently, telling readers to revoke notification permissions for “Ytmp3.cc (and convertytmp3.org, which Ytmp3 currently redirects to)”.
What we saw on 16 September 2026
| What we checked | What we saw |
|---|---|
| Result of typing ytmp3.cc | One HTTP 301 redirect, over HTTPS, over HTTP and with www; server header nginx |
| Final address | convertytmp3.org, HTTP 200, at ytmp3.cc's own IP address, 88.80.22.66, titled “YTMP3: Free YouTube to MP3 Converter”, with its canonical link there rather than on ytmp3.cc |
| Page | 7,621 bytes, 222 words of visible text, one link field, a format toggle, a Convert button |
| Formats offered | MP3 up to 240 minutes at 192 kbps, MP4 up to 30 minutes at 360p. No 320 kbps, 720p or 1080p, and its FAQ says the audio or video quality cannot be changed |
| Scripts in the HTML as served, before any click | No third-party scripts, no analytics or advertising tags, no Notification or service-worker calls. One same-origin file, 6,753 bytes |
| What that script does on Convert | On submit it appends a script element pointing at 9hito.com/hid.js, which returned 63,294 bytes of obfuscated JavaScript referencing ServiceWorker, PushManager, Notification and Subscribe |
| Service worker file | /sw.hid.js returned HTTP 200, one line long, importing a 118,017-byte file from 9hito.com that references push events |
| What Download opens | A new tab at epsiloncloud.org/new/, a 969-byte page titled “Redirect” that forwarded to yt.drimzzzz.info and, followed with curl, ended at kocmg.com |
| App or install prompts | None on the landing page, though the navigation links to a page offering Edge and Firefox add-ons |
What ytmp3.cc used to be
A converter in its own right. The Internet Archive's earliest capture, from 17 April 2017, shows a self-hosted tool: the heading “YouTube to mp3”, mp3 and mp4 toggles, and the line “Welcome to our website ytmp3.cc.” Its three most recent captures, from July and September 2026, all carry status 301.
The years between are documented mostly through legal reporting. TorrentFreak reported in October 2017 that YtMp3.cc and MP3Juices.cc had begun turning UK visitors away while staying reachable elsewhere, and said it was unclear why. In 2022 the complaints turned inward, with TorrentFreak describing notices sent for the YTMP3.cc brand asking Google to delist copycats.
In March 2023 TorrentFreak reported a Danish court order, obtained by Rights Alliance for IFPI, Sony Music, Universal Music and KODA, putting nine music piracy sites on the national ISP blocklist. Two of them were ytmp3.cc and ytmp3.plus, the second covered on our page on ytmp3.plus. Comparitech records further moves before the current one, to ytmp3.cs, ytmp3.ai and ytmp3.gs between July 2025 and spring 2026, calling four URL changes in under twelve months highly unusual for a legitimate business.
One date needs care. The registry record shows a registration event of 2 May 2024, easy to read as the year the site began. It cannot mean that: captures of the working site exist from 2017, and the entry records the current registration only.
Why people search “ytmp3 cc virus”
Because of what happened around the page, not what the converter handed over. Most of the write-ups that name this domain point at one mechanism: the browser notification permission. Surfshark's removal guide, published in June 2025, says the site often tries to persuade you to allow notifications, and that “granting permission lets it serve aggressive pop-up ads, even when you're not on the site”. That is the shape of the complaint: people stop visiting, and the messages keep coming.
MalwareTips, in 2022, described a site that “displays fake messages to trick you into subscribing to its spam push notifications”. PCrisk, published in 2019 and updated in 2022, lists the threat type as “Push notifications ads, Unwanted ads, Pop-up ads”. MacSecurity's Mac guide, published in 2019 and updated in December 2024, describes a rogue add-on left behind on the Mac that “recurrently triggers popup ads”.
None of that is peculiar to one address. Malwarebytes keeps a detection page for the category, PUP.Optional.PushNotifications, “a large collection of domains that deploy malicious or fraudulent web push notifications”, and a March 2026 post on quiz sites showing the lure: a permission box overlaid with text such as Click “Allow” to continue. Neither page mentions ytmp3, so both describe the trick, not this domain.
Is ytmp3.cc safe? What the reports say and do not say
Take the vendors at their word, in both directions. Moonlock's write-up, from March 2026, states that “Ytmp3.cc itself is not a virus.”, while calling the architecture that hosts it “a hotbed of viruses and other potentially dangerous issues”. ExpressVPN's guide, from February 2025, says it “isn't a virus in the traditional sense”. Surfshark, quoted above, is blunter about the surroundings than about the site itself. That is a delivery surface, not an infection.
What they do not say matters as much. None establishes who runs the domain. None says ytmp3.cc was blocked in Canada: the Federal Court order TorrentFreak reported in June 2026, the country's first against stream rippers, names the Y2Mate, YTMP3 and SaveFrom brands, but the domains ISPs must block are Y2mate.ws, YTmp3.lat, Savefrom.space and Spowload.cc. And none of the guides we read has re-tested the destination since the redirect appeared, which is why we read the script ourselves.
Age is the other caveat. PCrisk's page still lists a serving IP address of 88.212.246.252, while on the day we checked ytmp3.cc resolved to 88.80.22.66: a guide can be right about behaviour and out of date about plumbing at once.
Watch the ending of the name too, because the write-ups are per-domain. PCrisk has a separate guide for ytmp3.sh saying “We found that notifications from ytmp3[.]sh promote various investment scams.” It does not extend that to ytmp3.cc. Our list of every ytmp3 address we checked keeps them apart: ytmp3.cx and ytmp3.ai shared this destination, while ytmp3.nu, ytmp3.la and ytmp3.as went to a different one. We can vouch for the table, not for what an advert layer serves on a day we did not test.
If ytmp3 pop-ups keep appearing
The messages are not coming from the site in front of you. They come from a permission stored in your browser, which is why they continue after the tab is closed, and why the fix is a setting rather than a scan.
Two settings are involved, and they are not the same one. Google's help for Chrome notifications gives the desktop path as Settings, Privacy and security, Site settings, Notifications, then Add beside “Not allowed to send notifications”. Pop-ups and redirects are a separate Chrome setting, and Microsoft's Edge help draws the same line between the two.
Our page on ytmp3 pop-ups and notifications carries the step lists in full, for Chrome on Android, Safari, Edge and Samsung Internet.
If you came here for a converter
You are already on one. This site takes one YouTube link at a time and returns an MP3 at 192 to 320 kbps or an MP4 at up to 1080p. There are no playlists, no account, no adverts, no app and no browser notifications, so there is no permission prompt to accept. The privacy notice and the copyright and removals page cover the rest. Otherwise, paste a link on the home page.
Questions
What happened to ytmp3.cc?
It stopped serving its own converter. On 16 September 2026 the address returned a single redirect to convertytmp3.org, a domain registered in June 2026 that shared ytmp3.cc's IP address and nameservers. Comparitech records the same redirect and earlier moves.
Is ytmp3.cc safe to use?
We cannot tell you that, and nor can the guides. We can say what we saw: no third-party trackers in the served page, an outside script pulled in when you press Convert, and an advert chain behind the Download button.
Is ytmp3.cc a virus?
The vendors who wrote the removal guides say no. Moonlock says “Ytmp3.cc itself is not a virus.” and Comparitech says it does not directly install anything harmful. What they describe is unwanted adverts and browser notifications after a visit.
Why do I get ytmp3 pop-ups when I never visit the site?
Because a notification permission, once granted, keeps working on its own. Surfshark puts it plainly: allowing notifications lets a site serve adverts even when you are not on it. Revoke it in your browser settings and they stop.
Is ytmp3.cc the same as ytmp3.nu or ytmp3.cx?
Not the same page. On 16 September 2026 ytmp3.cx and ytmp3.ai landed on the same destination as ytmp3.cc, while ytmp3.nu, ytmp3.la and ytmp3.as went elsewhere. That is shared infrastructure, not shared ownership.
Convert a YouTube link here insteadOne link at a time: MP3 at 192 to 320 kbps, or MP4 up to 1080p. No account, no adverts, no app, no notifications.
Open the converter