Known malicious kithighphishing
Meta 'Page Appeal' kit — main.ca88c9b6.js cohort (content anchor)
family: meta-page-appeal
Short link:scanmalware.com/h/154
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. This entry tracks one build of the kit's React bundle.
Anchors
Provenance
Added: 2026-07-07 10:30
Anchor = the kit's own React bundle main.ca88c9b6.js on its pages.dev hosts (one build cohort). The page-title entry in the same family tracks the campaign across builds.
Sightings (10)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| sp0ct0-kornaq-biz-pramta-zodru.pages.dev | 516f93cd… | https://sp0ct0-kornaq-biz-pramta-zodru.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-forlen-biz-klamra-zefvor.pages.dev | d03760e6… | https://sp0ct0-forlen-biz-klamra-zefvor.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-sarvoq-biz-prusra-zumfel.pages.dev | 165a9ea8… | https://sp0ct0-sarvoq-biz-prusra-zumfel.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-lelvoq-biz-krenvo-fimqi.pages.dev | 970624ca… | https://sp0ct0-lelvoq-biz-krenvo-fimqi.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-harnoq-biz-pralso-zomtir.pages.dev | 6e7a3fd2… | https://sp0ct0-harnoq-biz-pralso-zomtir.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-kernaq-biz-plosra-fidkor.pages.dev | e97eacde… | https://sp0ct0-kernaq-biz-plosra-fidkor.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-lernox-biz-tramka-felqur.pages.dev | 263081d7… | https://sp0ct0-lernox-biz-tramka-felqur.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-garnix-biz-tralsa-femqur.pages.dev | 42d07688… | https://sp0ct0-garnix-biz-tralsa-femqur.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-belqor-biz-tralka-zifvem.pages.dev | f46be602… | https://sp0ct0-belqor-biz-tralka-zifvem.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-06 00:45 |
| sp0ct0-zorval-biz-talpra-mesqi.pages.dev | 1946283c… | https://sp0ct0-zorval-biz-talpra-mesqi.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-03 00:45 |