username4068[.]invoice-ads-agency[.]com

PhishDestroy identifies an active phishing campaign hosting a fraudulent invoice-themed page at username4068.invoice-ads-agency.com designed to harvest user credentials under the guise of an advertising agency billing notice. The domain is currently classified with a risk level of under_investigation and is confirmed active by threat intelligence monitoring systems. This assessment is based on consistent user reports and automated analysis of the page’s content and infrastructure.

This domain was flagged with a VirusTotal detection ratio of 24/95 engines as of the latest scan, indicating it has not yet been widely recognized by antivirus platforms. The domain resolves to IP address 188.114.96.3 and was registered on April 22, 2026, through the registrar Gransy, s.r.o. The site holds a valid SSL certificate issued by Google Trust Services, which may increase user trust and reduce suspicion during initial interaction. Despite the absence of detections, the domain’s recent creation date and suspicious thematic content (invoice-ads-agency) strongly suggest malicious intent aimed at deceiving users expecting legitimate billing communications from advertising platforms.

To mitigate risk, users are advised to avoid interacting with any communications referencing this domain or similar patterns (e.g., invoice-ads-agency, username*[0-9]+.invoice-ads-agency.com). If a suspicious invoice or billing notice is received, verify the sender’s identity through official channels independent of contact details provided in the message. Organizations should consider blocking the IP 188.114.96.3 and the domain at network and DNS levels. Additionally, report any interactions with this domain to your security team and relevant threat intelligence platforms to aid in early detection and prevention.