support-facebook[.]invoice-ads-program[.]com

PhishDestroy identifies an active brand impersonation threat targeting Facebook, centered on the domain support-facebook.invoice-ads-program.com. This domain is currently active and engaged in a high-risk phishing campaign designed to deceive users into believing they are interacting with a legitimate Facebook invoicing or advertising program.

This domain was flagged by 20 of 95 VirusTotal security vendors, indicating significant malicious intent. It was registered through Gransy, s.r.o., resolved to IP address 162.159.140.98, and was created on April 23, 2026. Additionally, the domain appears on 3 security blocklists and holds an SSL certificate issued by Google Trust Services, further enhancing its deceptive credibility.

Given its high-risk status and active campaign, users are strongly advised to avoid interacting with support-facebook.invoice-ads-program.com or any associated links. Organizations should ensure their security solutions are updated to block this domain and related infrastructure. Immediately report any suspicious activity to your security team and consider blocking the IP 162.159.140.98 at the network perimeter. For a detailed threat analysis, consult the full report associated with seed b93ed2.