Known malicious kitcriticalphishing

Marketplace "account restricted, verify your identity" scam panels behind a slide-to-verify Security Check gate

family: slider-gate-marketplace-verification-2026-11

Scam pages that tell a seller or account holder their account is restricted until they verify their identity and bank details within 24 hours, hidden behind a slide-to-verify "Security Check" gate. The gate is translated into about 25 languages. It solves a proof-of-work in the browser, fingerprints it, checks for automation tools, analyses the mouse path and watches two hidden honeypot fields, and it also carries a hidden block of random text dressed up as a shop. Only visitors it accepts are shown the scam on the same address; everyone else, automated visitors included, stays on the gate, and the bare host names redirect elsewhere. Two panel backends were seen behind it. One is a Swedish "Identitetsverifiering" page with the hitta.se logo and the Skatteverket emblem that leads to a bank choice, a card form and steps the operator triggers one by one (an SMS code, a bank-app push, a code given by phone, the card balance, photos of an ID card and a selfie), with a live support chat; it also carries pages for N26, iDEAL and Klarna. The other is a German Vinted "Identitätsprüfung" page with its own support chat. Lure links have been opened from Facebook. Seen in November 2026 on hitta.329188386[.]com, verify.payurate[.]com and vintedverify[.]de. A match means a page built from this gate or from one of these panels, or one of the known hosts.

Anchors

Hunting ruleSliderCaptcha_Cloaker_Gate
SMQL queryrun
hunting_rule:Marketplace_Verification_SPA_Payment_Panel OR hunting_rule:Marketplace_Verification_HardLink_Panel OR cookie_name:slider_captcha_session OR script_url:*/js/payment_log_handler.js OR script_url:*/js/payment_overlay_module.js OR script_url:*/static/style/sys_files/console-ban.min.js OR domain:329188386.com OR contacted_host:hitta.329188386.com OR domain:payurate.com OR contacted_host:verify.payurate.com OR domain:vintedverify.de

Provenance

Added: 2026-11-12 13:34
Rule anchor: the gate's own verification code (its verify endpoint, the honeypot flag and the names of its mouse-path checks), which every deployment shares whatever brand is behind it. Its variable names change on every page load, so only fixed strings are used. Two more hunting rules match the panels themselves, from their configuration and script structure: Marketplace_Verification_SPA_Payment_Panel (the Swedish panel and its payment and navigation scripts) and Marketplace_Verification_HardLink_Panel (the Vinted panel). Search anchor: those two rules, the gate's session cookie, the panels' script paths and the known hosts. Each victim gets a link with its own short path; the lure is served only on that path.

Sightings (6)Atom feed

HostScanScriptMatchScanned
hitta.329188386.com77f6c989…https://hitta.329188386.com/lOH4Grrv#htmlrule2026-11-12 12:46
hitta.329188386.com77f6c989…—query2026-11-12 12:46
hitta.329188386.com0ee73af3…https://hitta.329188386.com/q5Y228qA?fbclid=IwdGRjcAVhMJFleHRuA2FlbQIxMQBwZG9mBWZkaWQWUSAs_hx38iRDIl_5KYr57g4pABgkJ3NydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR8eGS-MWCSGmbc8IoF-0NiP0vD007ykkGa_hIFuOj-ObCjzXSu21BL_1CO5oA_aem_INEpSgJ26LkOmbX-XFeNLg#htmlrule2026-11-11 11:28
hitta.329188386.com0ee73af3…—query2026-11-11 11:28
vintedverify.de#htmle0fb6cb0…https://vintedverify.de#htmlrule2026-11-08 15:22
vintedverify.dee0fb6cb0…—query2026-11-08 15:22