Known malicious kithighphishing

Meta 'Page Appeal' kit — 0693dd46 bundle cohort (content anchor)

family: meta-page-appeal

Facebook/Meta Business Page-Appeal credential-phishing kit — NEW bundle cohort (rotated JS hash) not covered by the main.ca88c9b6.js / main.c3146523.js sibling anchors. Same 3-way datacenter cloaking (redirect to real facebook.com / blank decoy / lure); the 0693dd46 segment is present across all capture variants — Facebook-decoy title (232 hosts), 'Meta for Business | Page Appeal' lure (77), Cloudflare Suspected-Phishing interstitial. Byte-identical kit bundle, zero legit titles.

Anchors

content sha2560693dd46a180a448108e73a2ee26d1194e8d3c3f1cc8b9013e20a46f4623d324

TLSHT101F19FB9571AE124C7147A6B0CF85C7BE848433AEB6FDFA4377515E34A80AA47628CC4

Provenance

Added: 2026-07-11 18:48

2026-07-12: content-anchor sibling in meta-page-appeal family (kit rotates bundle hash; add cohort anchors per project_hunt_smql_content_anchor_split). content_sha256=0693dd46 on 344 scans, 52 under-called LOW (cloaked-stub captures), 291 already HIGH/CONFIRMED. Kit-specific (all Facebook/Meta phishing titles, <<10k). Found via campaign-cluster title sweep (51 LOW 'Meta for Business | Page Appeal' hosts). | 2026-07-12: canonical_ast_hash NULLed — it was a 15690-prevalence SHARED-LIB bundle (not kit code), flooring legit sites (walgreens.syf.com/vt.tiktok.com/eluniversal.com.mx/shoa.cl) as kit_roster FPs; content_sha256 tier (the real kit signal) retained.

Sightings (200)

Host	Scan	Script	Match	When
sp5ct-vasem-biz8-kurem-lonik.pages.dev	952aba32…	https://sp5ct-vasem-biz8-kurem-lonik.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-26 03:28
berxavi-gld-belmora-a2x7hq61.pages.dev	f64569fc…	https://berxavi-gld-belmora-a2x7hq61.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
berxavi-gld-belmora-a2x7hq61.pages.dev	f64569fc…	https://berxavi-gld-belmora-a2x7hq61.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
xelveta-gld-larnora-c2t6fc83.pages.dev	2a32ca12…	https://xelveta-gld-larnora-c2t6fc83.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
xelveta-gld-larnora-c2t6fc83.pages.dev	2a32ca12…	https://xelveta-gld-larnora-c2t6fc83.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
dravemi-gld-zorquni-r4x1hq97.pages.dev	28c2c765…	https://dravemi-gld-zorquni-r4x1hq97.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
dravemi-gld-zorquni-r4x1hq97.pages.dev	28c2c765…	https://dravemi-gld-zorquni-r4x1hq97.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
dravemi-gld-zorquni-r4x1hq97.pages.dev	dbd3b3ee…	https://dravemi-gld-zorquni-r4x1hq97.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
dravani-gld-belxora-r1m6fc97.pages.dev	dcb82fcf…	https://dravani-gld-belxora-r1m6fc97.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
dravani-gld-belxora-r1m6fc97.pages.dev	dbdab032…	https://dravani-gld-belxora-r1m6fc97.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
dravani-gld-belxora-r1m6fc97.pages.dev	dbdab032…	https://dravani-gld-belxora-r1m6fc97.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
xelveta-gld-larnora-c2t6fc83.pages.dev	b0886808…	https://xelveta-gld-larnora-c2t6fc83.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
berlona-gld-fenquza-p9v7fc34.pages.dev	facba481…	https://berlona-gld-fenquza-p9v7fc34.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
berxavi-gld-belmora-a2x7hq61.pages.dev	248743a9…	https://berxavi-gld-belmora-a2x7hq61.pages.dev/static/js/main.9ff7820e.js#webpack-module:8681	byte	2026-07-26 02:47
sp5ct-koril-biz8-vurem-falen.pages.dev	a2201381…	https://sp5ct-koril-biz8-vurem-falen.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-26 02:42
gfvcd03nhwu-klmqwfyn-4d3e9f-yh222a.pages.dev	ed055d8f…	https://gfvcd03nhwu-klmqwfyn-4d3e9f-yh222a.pages.dev/static/js/main.f826d8e7.js#webpack-module:8681	byte	2026-07-26 02:12
67zo80-87p-26i-s78to8-5qyp2.pages.dev	969ad8d4…	https://67zo80-87p-26i-s78to8-5qyp2.pages.dev/static/js/main.a1eb3a24.js#webpack-module:8681	byte	2026-07-26 02:07
sp4ct-sardelon-biz8-zorex-kalim.pages.dev	d61e769b…	https://sp4ct-sardelon-biz8-zorex-kalim.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-26 01:36
1v86c-xj4-v5vjn-1nd-g575.pages.dev	1dc1eb8c…	https://1v86c-xj4-v5vjn-1nd-g575.pages.dev/static/js/main.a1eb3a24.js#webpack-module:8681	byte	2026-07-26 01:31
sp4ct-zorvem-biz8-kurex-dalin.pages.dev	02ffd113…	https://sp4ct-zorvem-biz8-kurex-dalin.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-26 01:22
sp4ct-novarek-biz8-kalim-surex.pages.dev	e6ac5ee2…	https://sp4ct-novarek-biz8-kalim-surex.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-26 01:17
o2xs5-dkecxa-62wmne-6bgy5g.pages.dev	a86702f8…	https://o2xs5-dkecxa-62wmne-6bgy5g.pages.dev/static/js/main.a1eb3a24.js#webpack-module:8681	byte	2026-07-26 01:08
uqmzdz-w7ce-947-4g1br-a3w.netlify.app	89608883…	https://uqmzdz-w7ce-947-4g1br-a3w.netlify.app/static/js/main.015218d6.js#webpack-module:8681	byte	2026-07-26 00:53
kdply8avstr-blpqrkmja-4d9e1f-rqv42c.pages.dev	ba673b19…	https://kdply8avstr-blpqrkmja-4d9e1f-rqv42c.pages.dev/static/js/main.f826d8e7.js#webpack-module:8681	byte	2026-07-26 00:52
sp5ct-kasel-biz8-furem-horin.pages.dev	d3e66424…	https://sp5ct-kasel-biz8-furem-horin.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-26 00:50
sp5ct-zurem-biz8-lakev-forin.pages.dev	102c1b2a…	https://sp5ct-zurem-biz8-lakev-forin.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-26 00:40
lgeklo-15o5t-4tb-umvt-w9b4.pages.dev	8da59fbb…	https://lgeklo-15o5t-4tb-umvt-w9b4.pages.dev/static/js/main.a1eb3a24.js#webpack-module:8681	byte	2026-07-26 00:19
xu80-qyh104-lr35-w48mb3-ryjw.pages.dev	b9edfbf8…	https://xu80-qyh104-lr35-w48mb3-ryjw.pages.dev/static/js/main.a1eb3a24.js#webpack-module:8681	byte	2026-07-26 00:01
645uo-xttwz-84val-42ht-yhwhi.pages.dev	c1d0e72a…	https://645uo-xttwz-84val-42ht-yhwhi.pages.dev/static/js/main.a1eb3a24.js#webpack-module:8681	byte	2026-07-25 23:30
mkrjb2dqtwil-qtzxvnnx-5b0c7d-vzk00a.pages.dev	eac30a67…	https://mkrjb2dqtwil-qtzxvnnx-5b0c7d-vzk00a.pages.dev/static/js/main.f826d8e7.js#webpack-module:8681	byte	2026-07-25 23:18
gpo2g-iya7sj-dci0g-4jep-pv5c.pages.dev	467a3923…	https://gpo2g-iya7sj-dci0g-4jep-pv5c.pages.dev/static/js/main.a1eb3a24.js#webpack-module:8681	byte	2026-07-25 23:00
sp6ct-torzik-biz8-damrel-voskin.pages.dev	e8fce204…	https://sp6ct-torzik-biz8-damrel-voskin.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-25 22:44
sp4ct-pelvor-biz8-karim-nolax.pages.dev	34f489ed…	https://sp4ct-pelvor-biz8-karim-nolax.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-25 22:32
sp5ct-gurem-biz8-lonik-varex.pages.dev	a34d109e…	https://sp5ct-gurem-biz8-lonik-varex.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-25 22:25
sp4ct-alvorek-biz8-masen-forik.pages.dev	3fea9dde…	https://sp4ct-alvorek-biz8-masen-forik.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-25 22:15
phvjn6d15pli-bgrnduhy-8c1d0e-dru4a.pages.dev	5484898f…	https://phvjn6d15pli-bgrnduhy-8c1d0e-dru4a.pages.dev/static/js/main.f826d8e7.js#webpack-module:8681	byte	2026-07-25 21:20
klmqw47nhw-yhnujlpw-8b3a9d-klm79c.pages.dev	54a98d02…	https://klmqw47nhw-yhnujlpw-8b3a9d-klm79c.pages.dev/static/js/main.f826d8e7.js#webpack-module:8681	byte	2026-07-25 20:40
sp4ct-parlen-biz8-furex-kamor.pages.dev	d07f95e8…	https://sp4ct-parlen-biz8-furex-kamor.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-25 20:12
sp5ct-konel-biz8-vurem-harix.pages.dev	e5b92a64…	https://sp5ct-konel-biz8-vurem-harix.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-25 20:07
sp5ct-zonik-biz8-lureq-farem.pages.dev	f6d42cd5…	https://sp5ct-zonik-biz8-lureq-farem.pages.dev/static/js/main.1df27039.js#webpack-module:8681	byte	2026-07-25 19:17