facebook-payment[.]invoice-ads-process[.]com

PhishDestroy identifies facebook-payment.invoice-ads-process.com as an active Facebook invoice payment scam domain designed to impersonate legitimate Facebook payment portals. This threat exhibits high-risk characteristics and is currently operational, with confirmed malicious intent targeting users through brand impersonation tactics. This domain was flagged by 22 out of 95 VirusTotal security vendors, indicating widespread recognition of its malicious nature. Registered through Gransy, s.r.o. on May 03, 2026, it resolves to IP address 172.66.0.96 and holds a Google Trust Services SSL certificate, which attackers often exploit to appear legitimate. The domain appears on three major security blocklists, including Phishunt, OpenPhish, and PhishingArmy, further confirming its malicious status. These technical indicators collectively demonstrate a sophisticated phishing operation with high deceptive potential. To mitigate exposure to this threat, users should avoid clicking links from unsolicited emails or messages claiming to be from Facebook payment services. Verify any payment requests directly through Facebook’s official website or app, and report suspicious communications. Organizations should block this domain at the network level and educate users about recognizing invoice payment scams. If compromised, users should change passwords immediately and monitor financial accounts for unauthorized transactions.