meta-submission[.]invoice-ads-manager[.]com

PhishDestroy identifies meta-submission.invoice-ads-manager.com as an active fake-invoice phishing domain that attempts to trick employees into disclosing Office 365 or Google Workspace credentials under the guise of an urgent invoice-processing task. The lure mimics an internal corporate email thread about an overdue invoice needing immediate approval, but the attached link actually points to the rogue domain hosted on 172.66.0.96. Once on the page, victims are prompted to enter their company email and password, which are harvested and relayed to attacker-controlled servers before the user is redirected to the legitimate vendor portal, making the compromise nearly invisible to the victim. This style of invoice-themed credential phishing is increasingly common in BEC campaigns because it bypasses spam filters that focus on “Nigerian prince” lures and instead abuses legitimate business workflows. This domain was flagged by 13 out of 95 VirusTotal security vendors within hours of creation. The domain registration record shows it went live on April 28, 2026, giving it a very short operational lifespan so far. Registrant details point to Gransy, s.r.o., a Czech registrar often abused for bulletproof hosting and rapid domain cycling. The site is served over HTTPS using a Google Trust Services certificate, a tactic that lends superficial credibility to the fake login portal. The IP address 172.66.0.96 sits in the Cloudflare range, further complicating takedown efforts because Cloudflare frequently hosts newly registered malicious domains while reputation data propagates across security vendors. If you or someone in your organization entered credentials on this site, immediately change the password and enable multi-factor authentication on all connected accounts. Next, revoke any active sessions tied to the compromised password and scan endpoints for follow-on malware dropped by the phishing kit. Report the incident to your security team and consider a password-reset across the entire domain to contain lateral movement. Finally, share the IOCs with trusted threat-intel partners; the registrar and hosting pattern is still evolving, so intelligence-sharing can pre-empt the next wave of look-alike domains.