Known malicious kithighphishing
Meta 'Page Appeal' kit — main.c3146523.js cohort (content anchor)
family: meta-page-appeal
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. Anchored on the residential-capture title so all three capture variants are tracked together.
Anchors
Provenance
Added: 2026-07-07 10:30
2026-07-07: content-anchor sibling of SMQL hunt #147 (nodriver_title "Meta for Business"). Anchor = kit-own pages.dev React bundle main.c3146523.js. Sibling row because janitor + verdict floors skip smql-anchored hunts (see hunts 148/151 precedent).
Sightings (11)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| u7cl-1z3whh-eu7ylu-uik-fwxt.pages.dev | 5ffa0102… | https://u7cl-1z3whh-eu7ylu-uik-fwxt.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 15:50 |
| vh4b-1wxjig-qom-mf7w-pbvc.pages.dev | b20a46e7… | https://vh4b-1wxjig-qom-mf7w-pbvc.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 15:47 |
| xd1uk-u8022-hujg1m-dmqu-b3r.pages.dev | 92d189b2… | https://xd1uk-u8022-hujg1m-dmqu-b3r.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 13:48 |
| yi6-t76qu-0ozfx-xsu16l-3ghzi.pages.dev | 3d407db3… | https://yi6-t76qu-0ozfx-xsu16l-3ghzi.pages.dev/static/js/main.29dd277a.js | structure | 2026-07-23 12:51 |
| gornaqovi-biz-lenvutora-f4m3pz18.pages.dev | a07c7c93… | https://gornaqovi-biz-lenvutora-f4m3pz18.pages.dev/static/js/main.c3146523.js | byte | 2026-07-07 10:30 |
| ornaqemi-biz-zarkuremi-y8t2pc54.pages.dev | 800e9f06… | https://ornaqemi-biz-zarkuremi-y8t2pc54.pages.dev/static/js/main.c3146523.js | byte | 2026-07-07 10:30 |
| horvutela-biz-pramqeluta-h9t8db61.pages.dev | 5b3e5892… | https://horvutela-biz-pramqeluta-h9t8db61.pages.dev/static/js/main.c3146523.js | byte | 2026-07-07 10:30 |
| dorvaneli-biz-prenvalemi-c6m1db74.pages.dev | 4b5f7a16… | https://dorvaneli-biz-prenvalemi-c6m1db74.pages.dev/static/js/main.c3146523.js | byte | 2026-07-07 10:30 |
| cornaqexa-biz-lomqeruta-k3x9pz42.pages.dev | 834ed437… | https://cornaqexa-biz-lomqeruta-k3x9pz42.pages.dev/static/js/main.c3146523.js | byte | 2026-07-07 10:30 |
| ernaqemi-biz-zormutela-y8t5pc23.pages.dev | 34c82f2d… | https://ernaqemi-biz-zormutela-y8t5pc23.pages.dev/static/js/main.c3146523.js | byte | 2026-07-07 10:30 |
| torvaxuta-biz-pramqeluta-a6x1db82.pages.dev | 80aa21bf… | https://torvaxuta-biz-pramqeluta-a6x1db82.pages.dev/static/js/main.c3146523.js | byte | 2026-07-07 10:30 |