meta-id17667[.]invoice-ads-manager[.]com

PhishDestroy identifies meta-id17667.invoice-ads-manager.com as a confirmed Google invoice-themed phishing domain currently active in the wild, posing an elevated risk to potential victims.

This domain specifically targets Google Ads users through a spoofed invoice scam, purporting to be related to advertising payments. The infrastructure is hosted on IP address 162.159.140.98 and was registered through Gransy, s.r.o. on April 28, 2026. VirusTotal analysis shows that 18 of 95 security vendors have flagged this domain as malicious. Additionally, the site operates under a Google Trust Services SSL certificate, which may be used to deceive users into believing the page is legitimate. The domain remains unblocked by most major threat intelligence platforms at this time, compounding the risk of successful user engagement.

This campaign represents an active and ongoing threat, leveraging both social engineering through invoice impersonation and technical deception via a trusted SSL certificate. The domain's recent registration date and low detection rate among security vendors make it particularly dangerous, as it may evade automated defenses. Users who encounter this domain should not interact with it or enter any sensitive information. Organizations should immediately block meta-id17667.invoice-ads-manager.com at the network perimeter, update email filtering rules to quarantine similar lures, and consider updating user awareness training to highlight invoice-themed phishing tactics. This domain should be treated as high-confidence malicious and added to all relevant blocklists to prevent further exposure.