accounts.login.adsbillinghub.com

Google

https://accounts.login.adsbillinghub.com/v3/signin/identifier?continue=https://ads.google.com/aw/overview&gl=US&hl=en&prompt=select_account&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1328418016:1793843836504802 Access site

Screenshot

Investigate

Domain accounts.login.adsbillinghub.com33 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 209.38.44.178

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://accounts.login.adsbillinghub.com/v3/signin/identifi…

urlscan

Wayback

archive.today

Cert YE1

crt.sh

Censys

Google CT

Phishunt analysis Beta

38 medium suspicion suspiciousheuristic risk score · not a probability

Why?

+5.3 Keyword match
+5.1 Site cluster
+4.1 Brand in screenshot
+4.0 Young domain
+3.2 Brand favicon
+3.0 ASN reputation
+3.0 OpenPhish
+2.2 Country mismatch
+1.6 Favicon (kit)
+1.1 No CSP header
+1.1 No HSTS header
+0.9 Young certificate
+0.6 Brand impersonation in path
+0.6 Long domain
+0.6 Login text in screenshot
+0.4 Credential path
+0.3 Free CA
+0.3 Deep subdomain
+0.2 Suspicious TLD

23 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Fake Google sign-in page imitating the Google Ads account login flow, served from a deep subdomain of an unrelated domain on DigitalOcean. Likely harvests Google account credentials; flagged by OpenPhish.

OpenPhishBrand impersonation in pathCredential path

AI-generated from stored detector signals - the AI never visited the site. · 2026-11-05 · confidence 85%

Domain & Network

Whois

Registrar Dynadot Inc

Network

IP 209.38.44.178 DigitalOcean

Country