username8460[.]invoice-ads-program[.]com

username8460.invoice-ads-program.com is a subdomain of invoice-ads-program.com. PhishDestroy first observed the hostname on Apr 29, 2026. Stored content metadata identifies Facebook as the apparent target. The captured page title is “Accounts Centre”. Current evidence score: 95/100 (critical).

Positive findings are stored from 6 sources: VirusTotal, Spamhaus DBL, DNS security resolvers, Cloudflare Radar, URLQuery, and URLScan. VirusTotal recorded 24 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Mimecast, SOCRadar, Sophos, VIPRE, Webroot on Jun 27, 2026 at 02:00 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 18:31 UTC. DNS security checks returned 3 blocking results across 12 tested policies: Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Facebook and assigned phishing as its category on Jul 29, 2026 at 03:06 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Apr 29, 2026 at 01:10 UTC. PhishStats returned no feed match on Apr 29, 2026 at 01:11 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:27 UTC; content was unavailable. Registration records for the registrable domain invoice-ads-program.com list Gransy, s.r.o. as the registrar and Apr 23, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 162.159.140.98 on AS13335 (Cloudflare, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Google Trust Services as the certificate issuer with validity through Jul 27, 2026; checked Apr 29, 2026 at 02:00 UTC.

The content indicators and 6 positive source findings support the current Facebook impersonation and phishing classification. The target field identifies Facebook, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.