username8459[.]invoice-ads-program[.]com

PhishDestroy identifies the domain username8459.invoice-ads-program.com as an active crypto drainer, designed to intercept cryptocurrency transactions by masquerading as an invoice ads program. The threat type is classified as generic_phishing with an elevated risk level, indicating active exploitation. Security analyses reveal this domain is leveraging deceptive branding to trick users into authorizing malicious transactions, a common tactic among crypto-draining operations. This domain was flagged by 15 of 95 VirusTotal security vendors, demonstrating broad suspicion across the security community. It was registered through Gransy, s.r.o., resolving to IP address 162.159.140.98 and secured with a Google Trust Services SSL certificate. The domain was created on April 23, 2026, suggesting it is a recently deployed threat infrastructure. Further investigation places this domain in multiple blocklists, reinforcing its malicious nature despite the use of a legitimate SSL certificate. As of the latest assessment, username8459.invoice-ads-program.com remains active and operational. PhishDestroy has issued immediate classification updates to block this domain across its detection network. However, users interacting with this site face elevated risk of cryptocurrency theft through fake transaction approvals. Until site takedown occurs, users are strongly advised to avoid this domain entirely and verify any invoice-related links through trusted, offline channels.