meta-program[.]invoice-ads-manager[.]com

This domain, meta-program.invoice-ads-manager.com, is actively engaged in a phishing campaign impersonating Facebook’s Accounts Centre. Analysis indicates the site presents a fraudulent login interface designed to harvest user credentials, consistent with brand impersonation tactics targeting social media authentication portals. No direct evidence of a cryptocurrency drainer or malware deployment was observed, though credential theft remains the primary objective. The page title explicitly reads 'Accounts Centre,' reinforcing the Facebook branding deception. Technical indicators confirm elevated risk: the domain resolves to IP address 172.66.0.96, hosted on Cloudflare infrastructure in Canada, and was registered on April 28, 2026, through registrar Gransy, s.r.o. Detection metrics reveal 24 of 95 security vendors flag the domain on VirusTotal, while it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted communication but does not mitigate the underlying phishing threat. Google Safe Browsing currently does not list the domain, though this may reflect detection latency rather than benign status. As of this assessment, the phishing page remains active, with no evidence of takedown or mitigation. The use of Cloudflare obscures origin server details, complicating attribution and remediation efforts. Users encountering this domain are advised to avoid interaction, verify URL authenticity via official channels, and report the incident to relevant abuse contacts. Organizations should update blocklists to include this domain and monitor for credential reuse attempts stemming from this campaign. The elevated risk classification persists due to active exploitation and low detection coverage relative to established threat intelligence thresholds.