Known malicious kithighphishing
Meta Verified 'rewards' phishing kit — utils.js exfil (content anchor)
family: meta-verified-rewards
Facebook/Meta 'Meta Verified — rewards for you' credential-phishing campaign on disposable hosting (safe-badge-*/bluetick-* pages.dev tenants). A distinct kit from the Meta Page-Appeal campaign, luring users with a fake paid-verification reward. This entry tracks the kit's utils.js exfiltration script.
Anchors
Provenance
Added: 2026-07-06 20:21
Anchor = the kit's public/js/utils.js, which carries the exfiltration modules (sendToEmail, sendToTelegram, saveRecord, encrypt). The page-title entry in the same family tracks the lure itself.
Sightings (26)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| business-badge-vip-134523562123cscv.pages.dev | d17511f7… | https://business-badge-vip-134523562123cscv.pages.dev/public/js/utils.js | byte | 2026-10-07 12:47 |
| business-badge-vip-134523562123cscv.pages.dev | bdc2616e… | https://business-badge-vip-134523562123cscv.pages.dev/public/js/utils.js | byte | 2026-10-07 12:46 |
| business-badge-help-page-342dchsevrt7645.pages.dev | aef0347d… | https://business-badge-help-page-342dchsevrt7645.pages.dev/public/js/utils.js | byte | 2026-08-25 00:49 |
| business-badge-help-page-vip-bdf334567363v234ts.pages.dev | 7147861d… | https://business-badge-help-page-vip-bdf334567363v234ts.pages.dev/public/js/utils.js | byte | 2026-08-23 12:52 |
| business-badge-help-page-vip-bdf334567363c4t234t.pages.dev | a4955573… | https://business-badge-help-page-vip-bdf334567363c4t234t.pages.dev/public/js/utils.js | byte | 2026-08-23 12:52 |
| crisis-go-id-175088123287.pages.dev | 763bb83d… | https://crisis-go-id-175088123287.pages.dev/public/js/utils.js | byte | 2026-08-21 13:48 |
| business-badge-help-page-34251434.pages.dev | 5eb3bf72… | https://business-badge-help-page-34251434.pages.dev/public/js/utils.js | byte | 2026-08-20 01:47 |
| business-badge-vip-188213231asxzcas.pages.dev | f68f3465… | https://business-badge-vip-188213231asxzcas.pages.dev/public/js/utils.js | byte | 2026-07-28 13:51 |
| safe-badge-start-page-00001hello.pages.dev | 99a74194… | https://safe-badge-start-page-00001hello.pages.dev/public/js/utils.js | byte | 2026-07-21 12:46 |
| safe-badge-start-page-00001hello.pages.dev | 99a74194… | https://safe-badge-start-page-00001hello.pages.dev/public/js/utils.js | byte | 2026-07-21 12:46 |
| business-blue-tick-confirmed-000112026.pages.dev | 6fc0b519… | https://business-blue-tick-confirmed-000112026.pages.dev/public/js/utils.js | byte | 2026-07-20 00:46 |
| business-blue-tick-confirmed-000312026.pages.dev | a8f454f2… | https://business-blue-tick-confirmed-000312026.pages.dev/public/js/utils.js | byte | 2026-07-16 00:47 |
| business-blue-tick-confirmed-000332026.pages.dev | 463b970d… | https://business-blue-tick-confirmed-000332026.pages.dev/public/js/utils.js | byte | 2026-07-15 13:46 |
| business-blue-tick-confirmed-000122026.pages.dev | 35fa0e6e… | https://business-blue-tick-confirmed-000122026.pages.dev/public/js/utils.js | byte | 2026-07-14 13:46 |
| business-blue-tick-confirmed-000282026.pages.dev | 8b840e52… | https://business-blue-tick-confirmed-000282026.pages.dev/public/js/utils.js | byte | 2026-07-14 00:48 |
| business-blue-tick-confirmed-000222026.pages.dev | cdb03cfe… | https://business-blue-tick-confirmed-000222026.pages.dev/public/js/utils.js | byte | 2026-07-12 00:49 |
| start-page-34677-rfilvaprdsxicag-workers.pages.dev | 631373a5… | https://start-page-34677-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 12:48 |
| start-page-34677-rfilvaprdsxicag-workers.pages.dev | 631373a5… | https://start-page-34677-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 12:48 |
| start-page-85733-rfilvaprdsxicag-workers.pages.dev | 5fd897c2… | https://start-page-85733-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| start-page-85733-rfilvaprdsxicag-workers.pages.dev | 5fd897c2… | https://start-page-85733-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| start-page-89248-rfilvaprdsxicag-workers.pages.dev | 86ad2a90… | https://start-page-89248-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| start-page-89248-rfilvaprdsxicag-workers.pages.dev | 86ad2a90… | https://start-page-89248-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| business-badge-help-page-vip-00002-4156.pages.dev | 86721b7d… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |
| business-badge-help-page-vip-00002-4156.pages.dev | 86721b7d… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |
| business-badge-help-page-vip-00002-4156.pages.dev | 25583a80… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |
| business-badge-help-page-vip-00002-4156.pages.dev | 25583a80… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |