pages[.]invoice-ads-agency[.]com

PhishDestroy identifies pages.invoice-ads-agency.com as an active crypto drainer impersonating Meta’s Accounts Centre page title and branding. The domain leverages a generic but credible name paired with stolen page titles to trick users into connecting malicious cryptocurrency wallet drainers under the guise of “Facebook Account Center” verification or security updates. Historical telemetry shows this actor reuses similar seed patterns (c116d0), often targeting social media and financial services users through malvertising and phishing campaigns. This domain was registered on April 22, 2026 through Gransy, s.r.o., and currently resolves to IP 188.114.96.3. It holds a valid SSL certificate issued by Google Trust Services, which may help bypass browser security warnings. As of the latest check, VirusTotal shows zero detections (21/95 engines), and the domain remains unlisted on major blocklists, including Google Safe Browsing (GSB). The domain’s recent creation and clean reputation profile suggest it is still in early deployment or testing phase. The threat is currently active with no active takedowns or blocklist entries noted. Users are advised to verify all links—especially those claiming to direct to Meta’s Accounts Centre—using PhishDestroy or official Meta security portals. Until remediation occurs, the risk remains medium due to the domain’s low detection rate and plausible branding. Organizations should monitor for connections to 188.114.96.3 and consider DNS-level blocking of this IP range to preempt wallet drainer activity.