jon[.]whm[.]116-193-191-4[.]cpanel[.]site

This domain, jon.whm.116-193-191-4.cpanel.site, operates as a fraudulent credential-harvesting portal designed to mimic legitimate Meta Support pages. Visitors are presented with a deceptive login interface that closely resembles official Meta properties, including Facebook and Instagram support channels. The site is engineered to capture sensitive user credentials, such as usernames, passwords, and potentially two-factor authentication codes, which are then transmitted to unauthorized third parties. Such stolen credentials are frequently exploited for account takeovers, financial fraud, or further phishing campaigns targeting connected contacts. The presence of this site poses a direct risk to individual privacy and organizational security, particularly for users who may be tricked into believing they are interacting with authentic Meta support services. Analysis indicates this domain exhibits multiple high-risk characteristics consistent with phishing infrastructure. The domain was registered on March 07, 2026, through Tucows Domains Inc., an unusually recent creation date that deviates from established legitimate support portals. It resolves to the IP address 116.193.191.4, hosted within AS136052 (PT Cloud Hosting Indonesia), a network segment frequently associated with transient or malicious hosting. Notably, the domain lacks a valid SSL certificate, increasing the likelihood of unencrypted credential transmission. Security validation engines have flagged this domain as malicious, with 17 out of 95 vendors on VirusTotal detecting it as a phishing threat. Additionally, the domain appears on at least one security blocklist and is currently offline, suggesting prior detection and remediation efforts by hosting providers or security entities. Users who have interacted with jon.whm.116-193-191-4.cpanel.site should take immediate corrective actions to mitigate potential compromise. First, reset passwords for any accounts accessed or entered on the site, prioritizing Meta-related services such as Facebook, Instagram, and associated email accounts. Enable multi-factor authentication (MFA) using app-based or hardware tokens rather than SMS-based methods, which may be vulnerable to interception. Review account activity logs for unauthorized access or suspicious actions, such as unrecognized logins, message sends, or profile changes. If financial or payment information was submitted, monitor bank statements and credit reports for fraudulent transactions, and consider placing a fraud alert with relevant credit bureaus. Finally, report the domain to local cybersecurity authorities or consumer protection agencies to assist in broader threat mitigation efforts.