facebook-setting[.]invoice-ads-process[.]com

This domain, facebook-setting.invoice-ads-process.com, is flagged for brand impersonation targeting Facebook users through a credential harvesting scheme. The phishing page displays an 'Accounts Centre' title, mimicking Facebook's authentication interface to deceive victims into submitting login credentials. Analysis indicates the site employs modern web technologies, including Node.js, React, and Next.js, alongside Cloudflare hosting, suggesting an attempt to evade detection through legitimate-looking infrastructure. Technical indicators confirm elevated risk: the domain was registered on May 3, 2026, through Gransy, s.r.o., and resolves to IP address 162.159.140.98. VirusTotal reports 21 out of 95 security vendors detecting malicious activity, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by at least one anti-phishing system. No Google Safe Browsing (GSB) flags are recorded at this time, though this may reflect a lag in detection rather than absence of threat. The domain remains active, posing an ongoing risk to users who may encounter it through phishing emails, ads, or social engineering tactics. Response actions should include immediate blocking of the domain and IP at network and endpoint levels, alongside monitoring for related infrastructure (e.g., subdomains, newly registered lookalike domains). Users are advised to verify URLs before entering credentials, enable multi-factor authentication on Facebook accounts, and report suspicious links to their security teams. Despite current blocking efforts, the domain's use of Cloudflare and modern web frameworks may prolong its operational lifespan, warranting continued vigilance.