meta-id19239271[.]invoice-ads-program[.]com

This domain, meta-id19239271.invoice-ads-program.com, operates as a credential theft site specifically designed to harvest Facebook account logins. The page title 'Accounts Centre' mimics legitimate Facebook login portals, tricking users into entering sensitive credentials. Analysis indicates the site employs social engineering tactics to deceive victims into disclosing usernames, passwords, and potentially two-factor authentication codes, which attackers then exploit for unauthorized account access or further malicious activities. Infrastructure analysis reveals multiple indicators confirming the domain's malicious nature. The domain was registered on April 23, 2026, through Gransy, s.r.o., a registrar frequently associated with suspicious registrations. It resolves to the IP address 172.66.0.96, hosted on Cloudflare infrastructure in Canada, a common tactic to obscure origin servers. Security vendors on VirusTotal flagged the domain at a rate of 21 out of 95, with detection engines identifying it as a phishing threat. The SSL certificate issued by Google Trust Services (WE1) adds a superficial layer of legitimacy, though it does not mitigate the underlying threat. Users who visited meta-id19239271.invoice-ads-program.com should assume their credentials were compromised. Immediate actions include changing passwords for Facebook and any other accounts where identical credentials were reused. Enable two-factor authentication on all critical accounts, preferably using an authenticator app rather than SMS-based methods. Monitor accounts for unauthorized activity, such as unfamiliar posts, messages, or login attempts. If financial or personal data was entered, consider placing a fraud alert on credit reports and reviewing transactions for signs of misuse. The domain has since been taken offline, but similar threats may persist under different addresses.