username8436[.]invoice-ads-program[.]com

The domain username8436.invoice-ads-program.com has been identified as a source of fake login phishing activity. This domain is posing a significant threat to users by attempting to deceive them into providing sensitive login credentials under the guise of an 'Accounts Centre' page. The presence of such a page is a typical strategy employed by attackers to harvest user data for unauthorized access.

Evidence supporting this threat includes the domain being flagged by 24 out of 95 security vendors on VirusTotal, indicating a broad recognition of its malicious intent. The domain was registered through Gransy, s.r.o., a detail that could be relevant for tracking the origin of the threat actors. The domain's creation date is April 28, 2026, suggesting that the domain might be part of a pre-planned campaign. Furthermore, it is listed on at least one security blocklist and is blocked by a known phishing mitigation service.

Users who have visited this domain should immediately change any passwords they may have entered and monitor their accounts for unauthorized activity. It is also advisable to enable two-factor authentication on all accounts to add an extra layer of security. Reporting the domain to relevant security platforms can help others avoid falling victim to this phishing campaign. Users should remain vigilant and skeptical of unsolicited requests for login details, especially when presented with unfamiliar or suspicious domain names.