Known malicious kithighphishing
Meta 'Page Appeal' kit — main.c3146523.js cohort (content anchor)
family: meta-page-appeal
Short link:scanmalware.com/h/155
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. This entry tracks one build of the kit's React bundle.
Anchors
Provenance
Added: 2026-07-07 10:30
Anchor = the kit's own React bundle main.c3146523.js on its pages.dev hosts (one build cohort). The page-title entry in the same family tracks the campaign across builds.
Sightings (13)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| foit-k7v1m9-kvc4b-ciyox-tcgu.pages.dev | c715b341… | https://foit-k7v1m9-kvc4b-ciyox-tcgu.pages.dev/static/js/main.29dd277a.js | structure | 2026-08-13 12:45 |
| gorvanel-biz-zormutera-a1m9pc63.pages.dev | 3305b744… | https://gorvanel-biz-zormutera-a1m9pc63.pages.dev/static/js/main.c3146523.js | byte | 2026-08-13 12:45 |
| u7cl-1z3whh-eu7ylu-uik-fwxt.pages.dev | 5ffa0102… | https://u7cl-1z3whh-eu7ylu-uik-fwxt.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 15:45 |
| vh4b-1wxjig-qom-mf7w-pbvc.pages.dev | b20a46e7… | https://vh4b-1wxjig-qom-mf7w-pbvc.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 15:45 |
| xd1uk-u8022-hujg1m-dmqu-b3r.pages.dev | 92d189b2… | https://xd1uk-u8022-hujg1m-dmqu-b3r.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 13:45 |
| yi6-t76qu-0ozfx-xsu16l-3ghzi.pages.dev | 3d407db3… | https://yi6-t76qu-0ozfx-xsu16l-3ghzi.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 12:45 |
| torvaxuta-biz-pramqeluta-a6x1db82.pages.dev | 80aa21bf… | https://torvaxuta-biz-pramqeluta-a6x1db82.pages.dev/static/js/main.c3146523.js | byte | 2026-07-01 14:28 |
| ernaqemi-biz-zormutela-y8t5pc23.pages.dev | 34c82f2d… | https://ernaqemi-biz-zormutela-y8t5pc23.pages.dev/static/js/main.c3146523.js | byte | 2026-07-01 08:30 |
| cornaqexa-biz-lomqeruta-k3x9pz42.pages.dev | 834ed437… | https://cornaqexa-biz-lomqeruta-k3x9pz42.pages.dev/static/js/main.c3146523.js | byte | 2026-07-01 03:36 |
| dorvaneli-biz-prenvalemi-c6m1db74.pages.dev | 4b5f7a16… | https://dorvaneli-biz-prenvalemi-c6m1db74.pages.dev/static/js/main.c3146523.js | byte | 2026-06-30 23:25 |
| horvutela-biz-pramqeluta-h9t8db61.pages.dev | 5b3e5892… | https://horvutela-biz-pramqeluta-h9t8db61.pages.dev/static/js/main.c3146523.js | byte | 2026-06-30 18:22 |
| ornaqemi-biz-zarkuremi-y8t2pc54.pages.dev | 800e9f06… | https://ornaqemi-biz-zarkuremi-y8t2pc54.pages.dev/static/js/main.c3146523.js | byte | 2026-06-30 14:22 |
| gornaqovi-biz-lenvutora-f4m3pz18.pages.dev | a07c7c93… | https://gornaqovi-biz-lenvutora-f4m3pz18.pages.dev/static/js/main.c3146523.js | byte | 2026-06-30 09:36 |