username8461[.]invoice-ads-program[.]com

PhishDestroy identifies username8461.invoice-ads-program.com as an active crypto-drainer phishing site that masquerades as an invoice or ads program platform. The domain uses a generic username string to appear legitimate while hosting a drainer kit designed to siphon cryptocurrency from victims’ wallets upon wallet connection. No specific brand is directly impersonated in the domain or landing page structure, suggesting a broad, opportunistic campaign targeting crypto users under the guise of an advertising or invoicing service.

Technical indicators confirm the hostile nature of this domain. It was created on April 23, 2026, and resolves to IP 172.66.0.96. The domain uses a SSL certificate issued by Google Trust Services, likely to evade browser warnings and appear trustworthy. VirusTotal shows a detection ratio of 16 out of 95 security vendors flagging the domain as malicious. The registrar is Gransy, s.r.o., a known domain registrar often abused for bulk malicious registrations. Despite the SSL certificate, the domain is currently unlisted on Google Safe Browsing (GSB) and has not yet propagated widely across major threat intelligence feeds, indicating a newly launched attack vector with limited detection coverage.

As of the latest scan, the domain remains active and serves a live drainer payload. PhishDestroy has flagged the site and added it to real-time blocklists. Immediate user action is advised: avoid clicking links to invoice-ads-program.com or any subdomains, do not connect wallets, and verify unknown domains using PhishDestroy’s verification tool. While the current threat level is elevated due to active distribution and drainer payload, proactive blocking and user vigilance reduce exposure. Remaining risk includes potential domain rotation or rapid reuse in new campaigns, emphasizing the need for continuous monitoring and user education on crypto wallet security.