Possible campaigns

Beta16 live campaigns grouping 68 indicators across 16 brands, rebuilt daily. Shared-infrastructure grouping of public detections, not an attribution claim.

Recent Confidence Size
7 new in the last 7 days
PayPalNew
56474317e520
same apex · 8/8 members Aug 8 → Aug 9
60% suspected cluster
8 indicators · 3 active
Screenshot of trezor-app-bridge.typedream.app
TrezorNew
ec30a265c536
same apex · 3/3 members Aug 7 → Aug 9
68% suspected cluster
3 indicators · 3 active
Banco SantanderNew
f2b89aafdfff
same apex · 6/6 members Aug 5 → Aug 8
57% suspected cluster
6 indicators · 6 active
Screenshot of allegrolokalnie.lokalna-ofeta16xv0y2j0070.shop
AllegroNew
43716a09e8ed
same favicon · 3/3 members Aug 7
84% possible campaign
3 indicators · 1 active
Apple, FIFA World Cup, MicrosoftNew
418560c5037c
same favicon · 3/3 members Aug 6 → Aug 7
76% possible campaign
3 indicators · 3 active
Screenshot of santander2026.dothome.co.kr
Banco SantanderNew
0ab4e2dcc08a
dom signals exact · 3/3 members Aug 2 → Aug 5
80% possible campaign
3 indicators · 3 active
Screenshot of cn-netflix.cn
NetflixNew
b307e57080c7
same favicon · 3/3 members Aug 5
73% possible campaign
3 indicators · 3 active
Screenshot of agenciatributariaoopa.eu.cc
AEAT (Hacienda)
e25046b42b54
same nameservers · 3/3 members Jul 30
60% suspected cluster
3 indicators · 3 active
Screenshot of helpscontact-coinbase.com
Coinbase, Microsoft
1dedcfa35d5a
same favicon · 5/5 members May 22 → Jul 27
52% suspected cluster
5 indicators · 5 active
Screenshot of ingdirect-alerta-clientes.com
ING España
0c1b79ab9b24
similar text · 8/8 members Jul 11 → Jul 12
75% possible campaign
8 indicators · 8 active
Screenshot of programme-hup.m365-microsoft.com
Microsoft
40bef666f218
same apex · 3/3 members Mar 28 → Jun 8
60% suspected cluster
3 indicators · 3 active
Screenshot of business-dropbox.me
Dropbox, Facebook, LinkedIn, Microsoft
555474fbaa6d
same favicon · 7/7 members Apr 14 → May 30
53% suspected cluster
7 indicators · 7 active
Screenshot of binanceaa.com
Binance
1285296f1ed2
cert age window · 3/3 members May 20
87% possible campaign
3 indicators · 3 active
Screenshot of microsoft.authorised-support.com
Microsoft, PayPal
df3aee70a9d3
same TLS cert · 3/3 members May 12 → May 15
65% suspected cluster
3 indicators · 3 active
Screenshot of google28.m4ntapaset.ink
Google
f40d4e943382
dom signals exact · 3/3 members Apr 6 → Apr 12
90% possible campaign
3 indicators · 3 active
Screenshot of appengine.google.com.drive.pratham.vincacybertechltd.myshn.net
Google
8024d41f5c84
same apex · 4/4 members Apr 6
88% possible campaign
4 indicators · 4 active

Same data as JSON: /api/v1/campaigns

Recently dissolved
paypal 2026-08-09 apple 2026-08-08 fifa 2026-08-05 usps 2026-08-02 dhl 2026-08-01 google 2026-07-28 trustwallet 2026-07-27 microsoft 2026-07-26 microsoft 2026-07-19

A campaign dissolves when none of its indicators are in the active feed any more. Identifiers are stable, so an entry here comes back if the same infrastructure does.