user30[.]invoice-partners-agency[.]com

PhishDestroy identifies user30.invoice-partners-agency.com as an active credential theft campaign impersonating the Invoice Partners Agency. This domain leverages a fraudulent Accounts Centre page to harvest user login details, posing a direct risk to individuals expecting legitimate billing or account management communications. The page mimics formal business correspondence to increase legitimacy, making it particularly deceptive for recipients unfamiliar with the spoofed brand.

This domain was flagged by 24 out of 95 security vendors on VirusTotal, indicating widespread suspicion. It was registered through Gransy, s.r.o., on April 20, 2026, and has appeared on at least 2 security blocklists. The domain resolves to IP address 188.114.96.3 and utilizes an SSL certificate issued by Google Trust Services, which may further mislead users into believing the site is legitimate. The combination of recent domain creation, low blocklist prevalence at time of discovery, and partial SSL validation demonstrates the sophistication of the campaign.

Users who visited this domain and entered credentials or sensitive information should immediately change passwords for the affected account and enable two-factor authentication if available. Report the incident to your organization’s security team or the impersonated brand’s support channels. Avoid interacting with any subsequent emails from unknown senders and scan devices for malware using a reputable security tool. If financial details were provided, contact your bank to mitigate potential fraud. Users should also report the domain to their email provider and consider using browser-based phishing protection tools to prevent future exposure.