agency[.]invoice-ads-program[.]com

PhishDestroy identifies agency.invoice-ads-program.com as an active brand impersonation phishing domain targeting users with a deceptive 'Accounts Centre' page. The threat uses the Meta brand to lure victims into entering credentials or payment data, with no visible drainer kit detected during initial analysis. The domain mimics legitimate Meta infrastructure, leveraging HTTPS via Google Trust Services to enhance credibility. Registrant data is obscured through Gransy, s.r.o., a registrar known for low WHOIS privacy barriers, enabling rapid domain cycling.

This domain was flagged by PhishDestroy with zero VirusTotal detections (22/95 engines as of current scan) despite clear impersonation indicators. Technical indicators include resolution to IP 172.67.148.126, registered on April 23, 2026, via Gransy, s.r.o. The SSL certificate is issued by Google Trust Services, and the domain remains unblocked by Google Safe Browsing (GSB) as of this report. Given its recent creation and minimal detection footprint, the domain exhibits high evasion potential and low forensic coverage.

As of current analysis, agency.invoice-ads-program.com remains active and unmitigated. Users accessing this domain risk credential theft and financial loss via brand impersonation. Immediate network-level blocking is recommended, alongside user awareness campaigns targeting Meta login deception. Remaining risk is classified as under investigation due to evolving detection status and potential for rapid takedown evasion. Continuous monitoring and signature updates are required to prevent downstream compromise.