meta-action[.]invoice-ads-manager[.]com

This domain, meta-action.invoice-ads-manager.com, is flagged as an active credential theft operation targeting Facebook users through a fraudulent Accounts Centre interface. Analysis indicates the infrastructure is designed to harvest login credentials by mimicking Meta's authentication portal, a common tactic in social media account compromise schemes. No direct evidence of a crypto drainer kit or wallet interception script was observed, but the page title and visual elements strongly suggest credential harvesting as the primary objective. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Gransy, s.r.o., and currently resolves to IP address 172.66.0.96, hosted behind Cloudflare in Canada. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Security telemetry shows the domain is detected by 17 out of 95 vendors on VirusTotal and appears on one blocklist, with PhishDestroy actively blocking access. No Google Safe Browsing (GSB) listing was confirmed at the time of analysis, though this may reflect detection latency rather than absence of malicious activity. The domain remains active and poses an elevated risk to users, particularly those redirected from compromised advertisements or phishing links. Response actions should include immediate blocking of the domain and IP at network and endpoint levels, along with credential reset protocols for any users who may have interacted with the site. Despite Cloudflare's infrastructure providing anonymity, the combination of a future registration date, brand impersonation, and security vendor detections confirms malicious intent. Users are advised to verify domain authenticity before entering credentials and to enable multi-factor authentication on all social media accounts to mitigate potential compromise.