meta-backup[.]invoice-ads-program[.]com

PhishDestroy identifies meta-backup.invoice-ads-program.com as an active crypto drainer phishing domain impersonating Meta’s backup and ads program. The domain employs a spoofed login interface to harvest wallet credentials and initiate unauthorized crypto transfers. Threat actors leverage deceptive branding (Meta) and urgency (invoice/ads program) to trick users into connecting malicious wallets or submitting private keys.

This domain was flagged by 23 out of 95 VirusTotal security vendors, indicating elevated risk. It was registered on April 23, 2026, through Gransy, s.r.o., and resolves to IP 162.159.140.98. The domain holds a Google Trust Services SSL certificate, which may lend false legitimacy. It is blocked by OpenPhish and PhishingArmy, and appears on two additional security blocklists, confirming active abuse.

The domain remains active with an elevated risk profile due to its recent registration, high VT detection rate, and dual blocklist coverage. Users are advised to avoid interaction and verify any suspicious links using PhishDestroy’s real-time scanner. Remaining risk includes continued phishing campaigns, potential domain rotation, and wallet compromise leading to fund loss. Immediate defensive actions include DNS blocking and user awareness campaigns targeting crypto users.