invoice-partner[.]credit-agency-meta[.]com

This domain, invoice-partner.credit-agency-meta.com, is actively engaged in credential theft operations impersonating the Accounts Centre brand. Analysis indicates the site presents a fraudulent login interface designed to harvest user credentials, likely targeting individuals associated with financial or credit services. The domain does not exhibit characteristics of a crypto drainer or payment skimmer but instead focuses on traditional credential harvesting, a tactic commonly employed in phishing campaigns against corporate or financial service users. The page title, Accounts Centre, aligns with branding used by legitimate financial service portals, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain resolves to IP address 172.67.192.39, hosted by a content delivery network provider in Canada. It was registered on November 12, 2025, through Gransy, s.r.o., a registrar frequently associated with high-risk domains. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, though this does not mitigate the domain's malicious intent. VirusTotal reports 22 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. No detections from Google Safe Browsing were reported at the time of analysis, though this may reflect a lag in propagation rather than a clean status. The domain remains active, posing an elevated risk to users who may encounter it through phishing emails, malicious advertisements, or compromised links. Response actions should include immediate blacklisting of the domain across security gateways, DNS filtering, and endpoint protection systems. Organizations are advised to monitor for connections to 172.67.192.39 and alert users who may have interacted with the site. Given the domain's recent registration and active status, continued monitoring for related infrastructure, such as newly registered lookalike domains or associated IP ranges, is recommended. Users who entered credentials on this site should assume compromise and initiate password resets, multi-factor authentication reviews, and account activity audits on all associated services.