Known malicious kithighphishing
Meta Verified 'rewards' phishing kit — utils.js exfil (content anchor)
family: meta-verified-rewards
Facebook/Meta 'Meta Verified — rewards for you' credential-phishing campaign on disposable hosting (safe-badge-*/bluetick-* pages.dev tenants). A distinct kit from the Meta Page-Appeal campaign, luring users with a fake paid-verification reward. Anchored on the residential-capture lure title.
Anchors
Provenance
Added: 2026-07-06 20:21
2026-07-06: content-anchor sibling of hunt #148 (SMQL title hunt). Anchor = kit public/js/utils.js (exfil modules sendToEmail/sendToTelegram/saveRecord/encrypt). Separate row because the reanalyze janitor + verdict floors skip smql-anchored hunts; family groups them.
Sightings (18)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| safe-badge-start-page-00001hello.pages.dev | 99a74194… | https://safe-badge-start-page-00001hello.pages.dev/public/js/utils.js | byte | 2026-07-21 12:46 |
| safe-badge-start-page-00001hello.pages.dev | 99a74194… | https://safe-badge-start-page-00001hello.pages.dev/public/js/utils.js | byte | 2026-07-21 12:46 |
| business-blue-tick-confirmed-000112026.pages.dev | 6fc0b519… | https://business-blue-tick-confirmed-000112026.pages.dev/public/js/utils.js | byte | 2026-07-20 00:46 |
| business-blue-tick-confirmed-000312026.pages.dev | a8f454f2… | https://business-blue-tick-confirmed-000312026.pages.dev/public/js/utils.js | byte | 2026-07-16 00:47 |
| business-blue-tick-confirmed-000332026.pages.dev | 463b970d… | https://business-blue-tick-confirmed-000332026.pages.dev/public/js/utils.js | byte | 2026-07-15 13:46 |
| business-blue-tick-confirmed-000122026.pages.dev | 35fa0e6e… | https://business-blue-tick-confirmed-000122026.pages.dev/public/js/utils.js | byte | 2026-07-14 13:46 |
| business-blue-tick-confirmed-000282026.pages.dev | 8b840e52… | https://business-blue-tick-confirmed-000282026.pages.dev/public/js/utils.js | byte | 2026-07-14 00:48 |
| business-blue-tick-confirmed-000222026.pages.dev | cdb03cfe… | https://business-blue-tick-confirmed-000222026.pages.dev/public/js/utils.js | byte | 2026-07-12 00:49 |
| start-page-34677-rfilvaprdsxicag-workers.pages.dev | 631373a5… | https://start-page-34677-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 12:48 |
| start-page-34677-rfilvaprdsxicag-workers.pages.dev | 631373a5… | https://start-page-34677-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 12:48 |
| start-page-85733-rfilvaprdsxicag-workers.pages.dev | 5fd897c2… | https://start-page-85733-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| start-page-85733-rfilvaprdsxicag-workers.pages.dev | 5fd897c2… | https://start-page-85733-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| start-page-89248-rfilvaprdsxicag-workers.pages.dev | 86ad2a90… | https://start-page-89248-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| start-page-89248-rfilvaprdsxicag-workers.pages.dev | 86ad2a90… | https://start-page-89248-rfilvaprdsxicag-workers.pages.dev/public/js/utils.js | byte | 2026-07-11 00:47 |
| business-badge-help-page-vip-00002-4156.pages.dev | 86721b7d… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |
| business-badge-help-page-vip-00002-4156.pages.dev | 86721b7d… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |
| business-badge-help-page-vip-00002-4156.pages.dev | 25583a80… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |
| business-badge-help-page-vip-00002-4156.pages.dev | 25583a80… | https://business-badge-help-page-vip-00002-4156.pages.dev/public/js/utils.js | byte | 2026-07-06 20:19 |