account-facebook[.]invoice-ads-program[.]com

PhishDestroy identifies account-facebook.invoice-ads-program.com as an active brand impersonation domain targeting Facebook. The domain is currently engaged in fraudulent activities under the guise of a legitimate Facebook service, posing significant risks to unsuspecting users.

This domain was flagged by 22 of 95 VirusTotal security vendors, indicating widespread recognition of its malicious nature. Registered through Gransy, s.r.o., the domain resolves to IP address 162.159.140.98 and was created on April 23, 2026. It has been blocked by three major security blocklists, including Phishunt, OpenPhish, and PhishingArmy. The domain utilizes an SSL certificate issued by Google Trust Services, which may contribute to a false sense of legitimacy for potential victims.

Given the high-risk status and active impersonation of Facebook, immediate action is required. Users should avoid accessing this domain entirely, and organizations should consider blocking both the domain and its associated IP address at the network perimeter. Security teams are advised to update firewall rules and DNS filters to prevent inbound or outbound communications with this domain. Additionally, end-users should be alerted through security awareness training to recognize and report similar brand impersonation attempts associated with Facebook or other major platforms.