Known malicious kitcriticalphishing
login-client/metasuite Phishing Kit — main.js
family: login-client-metasuite-54de
4-host operator: login-client-6i5.pages.dev, metasuite-business.com cohort. Numbered "login-client" Cloudflare Pages deployments paired with "metasuite-business" branding — textbook MS 365 / business-suite credential-harvest naming.
Fingerprint anchors
Provenance
Added by: analyst
Added: 2026-05-27 07:09
4 hosts. login-client + metasuite-business branding.
Sightings (7)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| notcapcha-metasuite.com | 7dea7df4… | https://notcapcha-metasuite.com/static/js/main.16802086.js | structure | 2026-05-23 23:54 |
| notcapcha-metasuite.com | 3a51c692… | https://notcapcha-metasuite.com/static/js/main.16802086.js | structure | 2026-05-23 23:51 |
| notcapcha-metasuite.com | ae4ee90d… | https://notcapcha-metasuite.com/static/js/main.16802086.js | structure | 2026-05-23 23:15 |
| notcapcha-metasuite.com | 722fd29b… | https://notcapcha-metasuite.com/static/js/main.16802086.js | structure | 2026-05-23 23:13 |
| metasuite-business.com | 3634cfd4… | https://metasuite-business.com/static/js/main.6ab0f7d2.js | byte | 2026-05-23 21:42 |
| login-client-6i5.pages.dev | 9a13e150… | https://login-client-6i5.pages.dev/static/js/main.a15a2cd8.js | structure | 2026-05-22 13:55 |
| nocaptcha-metasuite.com | 9a984699… | https://nocaptcha-metasuite.com/static/js/main.6ab0f7d2.js | byte | 2026-05-22 13:22 |