facebook-agency[.]invoice-ads-process[.]com

This domain, facebook-agency.invoice-ads-process.com, is actively engaged in brand impersonation targeting Facebook. Analysis indicates the site mimics Facebook's Accounts Centre interface, likely to harvest credentials or financial information from unsuspecting users. The threat type is classified as brand_impersonation, with a focus on replicating official Facebook authentication workflows, including login and account verification pages. No specific drainer kit signatures have been identified, though the infrastructure aligns with credential phishing campaigns observed in prior Facebook-themed attacks.

Infrastructure analysis reveals the domain was registered on May 3, 2026, through Gransy, s.r.o., a registrar frequently associated with high-risk domains. It resolves to the IP address 172.66.0.96, geolocated to Canada and hosted on Cloudflare infrastructure. Detection metrics show 17 out of 95 security vendors flagging the domain as malicious on VirusTotal, while it appears on one additional security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend superficial legitimacy. Google Safe Browsing currently does not list the domain, though this may reflect a lag in detection rather than benign status.

The domain remains active, with no evidence of takedown or sinkholing at the time of analysis. Response actions should include immediate reporting to the registrar (Gransy, s.r.o.) and Cloudflare for abuse mitigation, as well as submission to additional blocklists to expand coverage. The elevated risk level persists due to the domain's operational status and the potential for credential compromise. Organizations are advised to block the domain at the network level and alert users to the impersonation threat, particularly those handling Facebook ad accounts or financial transactions. Monitoring for related domains registered under the same registrar or resolving to the same IP range is recommended to preempt further abuse.