user15[.]invoice-partners-agency[.]com

This domain, user15.invoice-partners-agency.com, operates as a credential theft platform designed to harvest login credentials through a fraudulent 'Accounts Centre' interface. Analysis indicates the page mimics legitimate authentication portals, likely targeting users of major social media or financial platforms. The inclusion of 'Accounts Centre' in the page title suggests an attempt to impersonate Meta's infrastructure, a common tactic to deceive users into entering sensitive credentials under false pretenses. The domain's infrastructure and content are optimized for rapid deployment and high-volume credential collection, increasing the risk of large-scale account compromises.

Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on April 24, 2026, through Gransy, s.r.o., a registrar frequently associated with phishing campaigns. It resolves to the IP address 188.114.97.3, hosted by CloudFlare, Inc. in Canada, which is often leveraged to obscure the true origin of malicious traffic. Detection metrics further substantiate the threat: 25 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), adds a superficial layer of legitimacy, though it does not mitigate the underlying risk.

Users who visited user15.invoice-partners-agency.com or entered credentials on the site should take immediate remediation steps. First, revoke any sessions or passwords associated with the compromised credentials, particularly for accounts linked to Meta or other platforms mimicked by the phishing page. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Monitor financial and communication platforms for signs of unauthorized activity, such as unusual login attempts or messages. If credentials were entered, assume they are compromised and avoid reusing them across other services. Finally, report the incident to relevant security teams or incident response platforms to assist in broader threat mitigation efforts.