Known malicious kithighphishing
Meta 'Page Appeal' kit — main.ca88c9b6.js cohort (content anchor)
family: meta-page-appeal
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. Anchored on the residential-capture title so all three capture variants are tracked together.
Anchors
Provenance
Added: 2026-07-07 10:30
2026-07-07: content-anchor sibling of SMQL hunt #147 (nodriver_title "Meta for Business"). Anchor = kit-own pages.dev React bundle main.ca88c9b6.js. Sibling row because janitor + verdict floors skip smql-anchored hunts (see hunts 148/151 precedent).
Sightings (10)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| sp0ct0-zorval-biz-talpra-mesqi.pages.dev | 1946283c… | https://sp0ct0-zorval-biz-talpra-mesqi.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-belqor-biz-tralka-zifvem.pages.dev | f46be602… | https://sp0ct0-belqor-biz-tralka-zifvem.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-garnix-biz-tralsa-femqur.pages.dev | 42d07688… | https://sp0ct0-garnix-biz-tralsa-femqur.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-harnoq-biz-pralso-zomtir.pages.dev | 6e7a3fd2… | https://sp0ct0-harnoq-biz-pralso-zomtir.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-lelvoq-biz-krenvo-fimqi.pages.dev | 970624ca… | https://sp0ct0-lelvoq-biz-krenvo-fimqi.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-lernox-biz-tramka-felqur.pages.dev | 263081d7… | https://sp0ct0-lernox-biz-tramka-felqur.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-sarvoq-biz-prusra-zumfel.pages.dev | 165a9ea8… | https://sp0ct0-sarvoq-biz-prusra-zumfel.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-kernaq-biz-plosra-fidkor.pages.dev | e97eacde… | https://sp0ct0-kernaq-biz-plosra-fidkor.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-forlen-biz-klamra-zefvor.pages.dev | d03760e6… | https://sp0ct0-forlen-biz-klamra-zefvor.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |
| sp0ct0-kornaq-biz-pramta-zodru.pages.dev | 516f93cd… | https://sp0ct0-kornaq-biz-pramta-zodru.pages.dev/static/js/main.ca88c9b6.js | byte | 2026-07-07 10:30 |