user1[.]invoice-ads-program[.]com

user1.invoice-ads-program.com is a subdomain of invoice-ads-program.com. PhishDestroy first observed the hostname on Apr 25, 2026. Stored content metadata identifies Facebook as the apparent target. The captured page title is “Accounts Centre”. Current evidence score: 95/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, Spamhaus DBL, DNS security resolvers, URLQuery, and URLScan. VirusTotal recorded 24 detections among 91 engines: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, Chong Lua Dao, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, MalwareURL, Mimecast, SOCRadar, Sophos, VIPRE, Webroot on Jun 27, 2026 at 02:00 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 18:33 UTC. DNS security checks returned 3 blocking results across 12 tested policies: Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. URLQuery recorded 2 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Facebook and assigned phishing as its category on Jul 29, 2026 at 03:07 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. Google Safe Browsing returned no flag on Apr 25, 2026 at 13:25 UTC. PhishStats returned no feed match on Apr 25, 2026 at 13:26 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:27 UTC; content was unavailable. Registration records for the registrable domain invoice-ads-program.com list Gransy, s.r.o. as the registrar and Apr 23, 2026 as the creation date. Registration preceded first observation by 2 days. At collection time, the hostname resolved to 104.21.39.208 on AS13335 (Cloudflare, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Google Trust Services as the certificate issuer with validity through Jul 24, 2026; checked Apr 25, 2026 at 14:00 UTC.

The content indicators and 5 positive source findings support the current Facebook impersonation and phishing classification. The target field identifies Facebook, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.