invoice-check[.]click

This domain is flagged as an elevated-risk phishing threat specializing in fake invoice scams targeting corporate finance teams and small businesses. Analysis indicates the infrastructure is designed to mimic legitimate invoice verification portals, likely distributing credential harvesting forms or malicious payment redirection links. The domain exhibits characteristics of a short-lived, high-impact campaign typical of business email compromise (BEC) operations. Infrastructure analysis reveals the domain was registered on April 18, 2026, through Global Domain Group LLC, with an SSL certificate issued by Let's Encrypt. It resolves to IP address 188.114.97.3 and employs Cloudflare with HTTP/3 support, including Cloudflare Browser Insights for performance monitoring. Detection metrics show 17 out of 95 security vendors flagging the domain on VirusTotal, while it appears on 2 independent security blocklists. The domain holds a trust score of 0/100 and is currently blocked by multiple detection engines. The page title consistently displays 'Loading...', a common tactic to mask malicious content until victim interaction occurs. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.97.3) at firewall and email gateway levels. Organizations should implement strict DMARC, DKIM, and SPF policies to prevent spoofed invoice emails from reaching end users. Finance teams must verify all payment requests through secondary channels, particularly those referencing invoice-check.click or similar domains. Security teams should monitor for connections to the IP and domain in network logs, focusing on outbound traffic from finance or accounting departments. Given the domain's current offline status, monitoring for re-registration or similar domains using the same registrar and hosting infrastructure is recommended.