Marketplace "account restricted, verify your identity" scam panels behind a slide-to-verify Security Check gate
Scam pages that tell a seller or account holder their account is restricted until they verify their identity and bank details within 24 hours, hidden behind a slide-to-verify "Security Check" gate. The gate is translated into about 25 languages. It solves a proof-of-work in the browser, fingerprints it, checks for automation tools, analyses the mouse path and watches two hidden honeypot fields, and it also carries a hidden block of random text dressed up as a shop. Only visitors it accepts are shown the scam on the same address; everyone else, automated visitors included, stays on the gate, and the bare host names redirect elsewhere. Two panel backends were seen behind it. One is a Swedish "Identitetsverifiering" page with the hitta.se logo and the Skatteverket emblem that leads to a bank choice, a card form and steps the operator triggers one by one (an SMS code, a bank-app push, a code given by phone, the card balance, photos of an ID card and a selfie), with a live support chat; it also carries pages for N26, iDEAL and Klarna. The other is a German Vinted "Identitätsprüfung" page with its own support chat. Lure links have been opened from Facebook. Seen in November 2026 on hitta.329188386[.]com, verify.payurate[.]com and vintedverify[.]de. A match means a page built from this gate or from one of these panels, or one of the known hosts.
Anchors
hunting_rule:Marketplace_Verification_SPA_Payment_Panel OR hunting_rule:Marketplace_Verification_HardLink_Panel OR cookie_name:slider_captcha_session OR script_url:*/js/payment_log_handler.js OR script_url:*/js/payment_overlay_module.js OR script_url:*/static/style/sys_files/console-ban.min.js OR domain:329188386.com OR contacted_host:hitta.329188386.com OR domain:payurate.com OR contacted_host:verify.payurate.com OR domain:vintedverify.deProvenance
Sightings (6)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| hitta.329188386.com | 77f6c989… | https://hitta.329188386.com/lOH4Grrv#html | rule | 2026-11-12 12:46 |
| hitta.329188386.com | 77f6c989… | — | query | 2026-11-12 12:46 |
| hitta.329188386.com | 0ee73af3… | https://hitta.329188386.com/q5Y228qA?fbclid=IwdGRjcAVhMJFleHRuA2FlbQIxMQBwZG9mBWZkaWQWUSAs_hx38iRDIl_5KYr57g4pABgkJ3NydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR8eGS-MWCSGmbc8IoF-0NiP0vD007ykkGa_hIFuOj-ObCjzXSu21BL_1CO5oA_aem_INEpSgJ26LkOmbX-XFeNLg#html | rule | 2026-11-11 11:28 |
| hitta.329188386.com | 0ee73af3… | — | query | 2026-11-11 11:28 |
| vintedverify.de#html | e0fb6cb0… | https://vintedverify.de#html | rule | 2026-11-08 15:22 |
| vintedverify.de | e0fb6cb0… | — | query | 2026-11-08 15:22 |