sion200506[.]github[.]io

This domain is an active impersonation of Facebook designed to harvest user credentials. Visitors to sion200506.github.io are presented with a fraudulent login page that mimics Facebook’s interface, tricking users into entering their account details. The site may also attempt to distribute malware or initiate unauthorized account access once credentials are captured. Such impersonation attacks are commonly used to facilitate identity theft, financial fraud, or further phishing campaigns targeting the victim’s contacts. Analysis indicates this domain is hosted on GitHub infrastructure and resolves to the IP address 185.199.111.153, associated with AS54113 (Fastly, Inc.). The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites. VirusTotal detection shows 12 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The page title explicitly displays 'Facebook,' reinforcing its deceptive intent. No legitimate creation date is publicly available, but the domain remains actively hosted. If you visited sion200506.github.io and entered any credentials, immediately change your Facebook password and enable multi-factor authentication. Review your account for unauthorized activity, such as unfamiliar posts, messages, or linked devices. Scan your device for malware using updated security software, as the site may have attempted to deliver additional payloads. Avoid clicking on links from untrusted sources, and verify the URL of any login page before entering sensitive information. Report the domain to Facebook’s abuse team and consider notifying contacts who may have received suspicious messages from your account.