username8460[.]invoice-ads-program[.]com

This domain is an active credential theft operation designed to harvest Facebook account credentials by mimicking the platform's Accounts Centre interface. The site presents a fraudulent login portal that closely resembles legitimate Facebook authentication pages, tricking users into entering their usernames and passwords. Once submitted, these credentials are captured by threat actors for account takeover, financial fraud, or further phishing distribution. Analysis indicates this is a sophisticated campaign with multiple technical indicators of compromise. The domain was registered on April 23, 2026, through Gransy, s.r.o., a registrar frequently associated with malicious infrastructure. It resolves to 162.159.140.98, a Cloudflare IP address in Canada, which is commonly used to mask origin servers. Security vendors have detected this domain at scale, with 24 out of 95 engines on VirusTotal flagging it as malicious. Additionally, it appears on one security blocklist and uses a Google Trust Services SSL certificate (WE1), which provides a false sense of legitimacy to potential victims. If you visited this domain or entered credentials, immediate action is required. First, change the password for the affected Facebook account and enable multi-factor authentication if not already active. Review recent account activity for unauthorized logins or posts. Scan your device with updated security software to detect any malware that may have been installed during the interaction. Monitor linked accounts, such as email or financial services, for suspicious activity, as compromised credentials are often reused across platforms. Report the incident to Facebook's abuse team and consider notifying contacts who may have received fraudulent messages from your account.