meta-id19239207[.]invoice-ads-setting[.]com

This domain, meta-id19239207.invoice-ads-setting.com, is flagged for brand impersonation targeting Meta, the parent company of Facebook and Instagram. Analysis indicates the site presents a deceptive 'Accounts Centre' interface, a common tactic in credential harvesting schemes. The domain does not appear to deploy a known drainer kit but instead mimics Meta’s authentication portal to capture login credentials, potentially leading to account takeovers or unauthorized access to linked services. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to IP address 172.66.0.96, hosted on infrastructure associated with Cloudflare, Inc. in Canada. It was registered on May 03, 2026, through Gransy, s.r.o., a registrar frequently observed in phishing campaigns. Security vendors on VirusTotal flag the domain at a ratio of 18/95, while it appears on one security blocklist and is actively blocked by enterprise phishing detection systems. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate legitimacy, as fraudulent sites commonly use valid certificates to appear trustworthy. Current status remains active, posing an elevated risk to users. The domain’s infrastructure, combined with its impersonation of Meta’s branding and authentication flow, suggests a targeted phishing operation. Immediate response actions include blocking the domain at the DNS or network level, revoking any associated SSL certificates, and notifying the registrar for takedown. Users who may have interacted with the site should reset credentials on all linked accounts, enable multi-factor authentication, and monitor for unauthorized activity. Despite mitigation efforts, the domain’s use of content delivery network infrastructure may prolong its availability, requiring ongoing vigilance from security teams.