meta-id19239273[.]invoice-ads-program[.]com

This domain, meta-id19239273.invoice-ads-program.com, poses a credential harvesting threat designed to impersonate Meta's Accounts Centre. Visitors to the site are presented with a fraudulent login interface mimicking legitimate Meta services, intended to steal usernames, passwords, and potentially multi-factor authentication codes. The site specifically targets users expecting to manage their Meta-related accounts, exploiting trust in the brand to capture sensitive credentials for unauthorized access or further malicious activity. Analysis indicates the domain was registered on April 23, 2026, through the registrar Gransy, s.r.o., an unusually future-dated creation that may suggest attempts to bypass initial scrutiny or domain reputation checks. Infrastructure analysis reveals the domain resolves to the IP address 162.159.140.98, hosted on Cloudflare infrastructure in Canada, which is commonly leveraged to obscure the true origin of malicious sites. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, with detections specifically categorizing it as a phishing threat. The domain also appears on one security blocklist and uses an SSL certificate issued by Google Trust Services, which while legitimate, does not validate the site's authenticity. If you visited meta-id19239273.invoice-ads-program.com or entered any credentials, immediate action is required. First, change the passwords for any accounts accessed through the site, prioritizing Meta and associated email accounts. Enable multi-factor authentication if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor linked accounts for unauthorized activity, such as unexpected login attempts or changes to account settings. Consider revoking access to any third-party applications connected to the compromised account. If financial or payment information was entered, contact your financial institution to secure accounts and review recent transactions. Finally, scan your device for malware using updated security tools to ensure no additional compromise has occurred.