id-facebook[.]invoice-ads-program[.]com

PhishDestroy identifies id-facebook.invoice-ads-program.com as a high-risk brand impersonation domain actively posing as Facebook to distribute an invoice scam. The domain uses a deceptive naming convention that mimics official Facebook communications, suggesting it is part of a larger campaign targeting users with fraudulent billing notifications. No specific drainer kit is associated with this domain in open intelligence feeds, but the structure and naming align with common phishing lures used to harvest credentials and payment information under the guise of account billing disputes. This domain employs HTTPS via a Google Trust Services certificate, increasing its perceived legitimacy to unsuspecting victims.

This domain was flagged by 21 out of 95 security vendors on VirusTotal, indicating significant malicious recognition. It was registered through Gransy, s.r.o. on April 23, 2026, and resolves to IP address 162.159.140.98. It has been identified by Google Safe Browsing as unsafe and is currently included on 3 active blocklists maintained by Phishunt, OpenPhish, and PhishingArmy. The SSL certificate issued by Google Trust Services may be leveraged to bypass traditional browser warnings, making this threat particularly effective at deception.

As of the latest analysis, id-facebook.invoice-ads-program.com remains active and poses a high risk to users who may receive fraudulent billing notifications impersonating Facebook. Immediate action by security teams is recommended: block the domain at DNS and network levels, update firewall rules to deny traffic to 162.159.140.98, and alert users to avoid interacting with any emails or messages referencing 'Facebook Invoice Ads Program.' While the domain is widely detected and blocked by major threat intelligence platforms, its recent creation and SSL certificate suggest ongoing refinement by threat actors. Users should treat any unsolicited invoice or billing notice from 'Facebook' as highly suspicious and verify through official channels. Remaining risk is moderate due to high blocklist coverage, but continued vigilance is necessary as threat actors frequently shift infrastructure to evade detection.