meta-debit[.]invoice-ads-manager[.]com

This domain, meta-debit.invoice-ads-manager.com, is a phishing site designed to steal Facebook login credentials by impersonating the platform's Accounts Centre. Visitors are presented with a fraudulent login interface that closely resembles Facebook's legitimate authentication portal, tricking users into entering their usernames and passwords. The stolen credentials are then harvested by threat actors for unauthorized account access, financial fraud, or further social engineering attacks targeting connected contacts or business pages. Analysis indicates this domain was registered on May 5, 2026, through Gransy, s.r.o., a registrar frequently associated with phishing infrastructure. It resolves to the IP address 172.66.0.96, hosted behind Cloudflare in Canada, which is commonly used to obfuscate malicious origins. The domain is flagged by 17 out of 95 security vendors on VirusTotal and appears on at least one security blocklist. Its SSL certificate, issued by Google Trust Services (WE1), adds a superficial layer of legitimacy, though this is a common tactic in phishing campaigns to evade browser warnings. If you visited meta-debit.invoice-ads-manager.com and entered your credentials, immediate action is required. First, change your Facebook password using a secure device and enable multi-factor authentication if not already active. Review your account for unauthorized logins, linked apps, or recent activity that you do not recognize. Notify Facebook of the compromise through their official reporting channels. Additionally, monitor connected accounts, such as email or financial services, for signs of unauthorized access, as stolen credentials are often reused across platforms. Avoid interacting with any emails or messages claiming to be from Facebook regarding this incident, as follow-up phishing attempts are likely.