username5642[.]invoice-ads-agency[.]com

This domain, username5642.invoice-ads-agency.com, is flagged as an active credential harvesting phishing site targeting users through a fraudulent Accounts Centre interface. The threat type is classified as generic_phishing with an elevated risk level, indicating a high probability of credential theft or unauthorized account access. The domain is designed to deceive users into entering sensitive login information, which is then captured by threat actors for malicious purposes. Analysis indicates the domain was registered on April 26, 2026, through Gransy, s.r.o., a registrar frequently associated with suspicious domains. It resolves to the IP address 188.114.97.3, located in Canada and hosted by CloudFlare, Inc., a common infrastructure provider for both legitimate and malicious sites. The SSL certificate is issued by Google Trust Services (WE1), which, while providing encryption, does not validate the legitimacy of the site. Detection metrics reveal that 24 out of 95 security vendors on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on one security blocklist, and its page title, Accounts Centre, is a known tactic used to mimic legitimate login portals. Mitigation steps for this specific threat include immediate blocking of the domain and its associated IP address (188.114.97.3) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to username5642.invoice-ads-agency.com or similar subdomains. End users should be educated on recognizing phishing indicators, such as mismatched URLs, suspicious SSL certificates, and unsolicited login prompts. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of credential theft. Monitoring for unauthorized access attempts linked to this domain is recommended, along with reporting the site to relevant threat intelligence platforms for broader awareness.