meta-id[.]invoice-ads-manager[.]com

This domain, meta-id.invoice-ads-manager.com, operates as a fraudulent login portal designed to harvest user credentials by impersonating a legitimate Meta (Facebook) Accounts Centre interface. The site mimics the appearance of official Meta authentication pages, presenting a deceptive "Accounts Centre" page title to trick visitors into entering sensitive login information. Such tactics are commonly employed in credential theft campaigns, where stolen credentials are later used for unauthorized account access, financial fraud, or further phishing distribution. The elevated risk level is due to the domain's active status and its ability to convincingly replicate trusted brand interfaces, increasing the likelihood of successful deception. Analysis indicates this domain was registered on April 28, 2026, through the registrar Gransy, s.r.o., a provider frequently associated with high-risk domains. The domain resolves to the IP address 162.159.140.98, which is part of Cloudflare’s infrastructure, a common obfuscation tactic to conceal the true hosting origin. Detection metrics further confirm its malicious nature, with 21 out of 95 security vendors on VirusTotal flagging the domain as phishing-related. Additionally, the domain appears on one security blocklist and is blocked by at least one anti-phishing service. The use of modern web technologies such as Node.js, React, Next.js, and HTTP/3 suggests an attempt to create a polished, legitimate-looking interface to evade user suspicion. If a user has visited meta-id.invoice-ads-manager.com and entered credentials, immediate action is required to mitigate potential damage. First, change the password for the affected Meta account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Monitor the account for unauthorized activity, such as unrecognized logins, messages sent without consent, or changes to account settings. Users should also scan their devices for malware, as phishing sites may redirect to or host malicious payloads. Finally, report the incident to the legitimate platform being impersonated to assist in broader takedown efforts. Avoid interacting with the domain further, as it remains active and poses an ongoing threat.