username3586[.]invoice-ads-agency[.]com

PhishDestroy has identified the domain username3586.invoice-ads-agency.com as a live crypto drainer impersonating an invoice advertising agency. This fraudulent site was registered on April 22, 2026, through the Gransy, s.r.o. registrar and resolves to IP address 188.114.97.3. The domain currently shows zero detections on VirusTotal’s 95-scanner grid and carries a Google Trust Services SSL certificate, which attackers abuse to appear legitimate and bypass browser warnings. Security telemetry indicates the site is actively hosting malicious JavaScript designed to intercept and divert cryptocurrency transactions to attacker-controlled wallets, effectively draining victim funds without their knowledge. This domain was flagged under seed 92580a with a current status of active and an under-investigation risk level. Technical indicators include the creation timestamp of April 22, 2026, a single registrar (Gransy, s.r.o.), zero VirusTotal detections across 95 engines, and a clean IP reputation at the time of analysis. The presence of a Google Trust Services SSL certificate further increases the risk of user trust exploitation, as modern browsers do not flag such certificates as suspicious, even when the site’s content is malicious. Given the domain’s recent registration and lack of blocklist entries, it is likely part of a rapidly evolving campaign targeting individuals or businesses expecting legitimate invoice-related services. Users who have visited or interacted with username3580.invoice-ads-agency.com should immediately cease all cryptocurrency transactions from wallets used on that site. Disconnect affected devices from the internet, scan for malware, and revoke any wallet approvals made on the domain. Report the domain and any transaction hashes to PhishDestroy using the unique seed 92580a for accelerated takedown and threat intelligence sharing. Use only verified, official channels for invoice and ad-related services and verify domains through trusted sources before entering any credentials or making payments.