invoice-payment[.]invoice-ads-program[.]com

invoice-payment.invoice-ads-program.com is a subdomain of invoice-ads-program.com. PhishDestroy first observed the hostname on Apr 30, 2026. The captured page title is “Accounts Centre”. Current evidence score: 100/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, Spamhaus DBL, DNS security resolvers, Cloudflare Radar, and URLQuery. VirusTotal recorded 25 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, OpenPhish, Seclookup, Sophos, VIPRE, Webroot on Apr 30, 2026 at 15:42 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 18:31 UTC. DNS security checks returned 5 blocking results across 14 tested policies: Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. Non-positive and contextual checks: ScamAdviser assigned a trust score of 1/100 (Very Likely Unsafe); no observation timestamp was retained. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. On Apr 30, 2026 at 15:27 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict on Jul 29, 2026 at 03:06 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:17 UTC; content was unavailable. Registration records for the registrable domain invoice-ads-program.com list Gransy, s.r.o. as the registrar and Apr 23, 2026 as the creation date. Registration preceded first observation by 7 days. At collection time, the hostname resolved to 172.66.0.96 on AS13335 (Cloudflare, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Google Trust Services as the certificate issuer with validity through Jul 29, 2026; checked Apr 30, 2026 at 17:00 UTC.

The content indicators and 5 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.