Possible campaigns
Beta10 live campaigns grouping 65 domains (65 indicators) across 8 brands, rebuilt daily. Shared-infrastructure grouping of public detections, not an attribution claim.
Data built 2026-11-01 05:00 UTC · rebuilt daily
CoinbaseNew
553b4d5d6d60
86%
possible campaign
3 domains · 3 hosts · 3 active
AppleNew
df9dfc39bdd7
74%
possible campaign
4 domains · 4 hosts · 3 active
AllegroNew
d02f332ee23a
77%
possible campaign
5 domains · 5 hosts · 3 active
RobloxNew
907f9b909c43
52%
suspected cluster
3 domains · 3 hosts · 3 active
ING EspañaNew
83c285b9ea25
60%
suspected cluster
3 domains · 3 hosts · 3 active
WhatsAppNew
42fab2e06fae
50%
suspected cluster
29 domains · 29 hosts · 25 active
WhatsApp
239866029b03
58%
suspected cluster
8 domains · 8 hosts · 8 active
WhatsApp
a6026b86a904
67%
suspected cluster
3 domains · 3 hosts · 3 active
DPD
52f8809ec852
68%
suspected cluster
4 domains · 4 hosts · 4 active
Google
ac8520eb2371
56%
suspected cluster
3 domains · 3 hosts · 3 active
Recently dissolved
whatsapp
2026-11-01
whatsapp
2026-11-01
whatsapp
2026-11-01
allegro
2026-11-01
allegro
2026-10-31
microsoft
2026-10-29
fedex
2026-10-29
google
2026-10-29
allegro
2026-10-28
allegro
2026-10-27
A campaign dissolves when none of its indicators are in the active feed any more. Its key is derived from the exact member set, so only an essentially identical set of members revives the same identifier; a merged or split campaign instead continues under its successor's key.
Methodology & provenance
- Generated
- 2026-11-01 05:00 UTC
- Algorithm
- corr-1.4.0
- Input rows
- 1194
- Candidate pairs
- 41514
- Edges written
- 7618
- Clusters written
- 10
- Runtime
- 45.3s
Shared infrastructure excluded from clustering: 15 apex domains, 1 TLS cert fingerprints, 2 favicon hashes, 2 redirect targets, 9 IPs, 2 nameserver sets, 13 TLS SAN entries, 1 screenshot hashes.