facebook-active[.]invoice-ads-agency[.]com

The domain facebook-active.invoice-ads-agency.com is currently active and is flagged for brand impersonation, specifically targeting Facebook. The threat level is elevated, indicating a significant risk to users who may be deceived by the domain's resemblance to legitimate Facebook services.

Analysis indicates that the domain has been flagged by 23 of 95 security vendors on VirusTotal, suggesting that a notable portion of the security community recognizes it as a threat. The domain is registered through Gransy, s.r.o., a registrar known for occasional association with malicious activities. It was created on April 22, 2026, which is relatively recent, indicating a fresh and potentially ongoing campaign. The domain resolves to the IP address 172.66.0.96, which is hosted by Cloudflare, Inc., a reputable content delivery network (CDN). However, the SSL certificate is issued by Google Trust Services, which may lend a false sense of security to unsuspecting visitors. The domain is also listed on one security blocklist and is blocked by PhishDestroy, a security service that identifies and mitigates phishing threats.

Given the current status of the domain as active and the elevated risk level, it is imperative that users and organizations take immediate action to protect themselves. Users should avoid clicking on links or entering personal information on this domain. IT security teams are advised to block this domain at the network level and monitor for any related malicious activities. Additionally, reporting this domain to Facebook and relevant security authorities can help mitigate the threat and protect a broader audience.