Possible campaigns

Beta5 live campaigns grouping 20 domains (20 indicators) across 7 brands, rebuilt daily. Shared-infrastructure grouping of public detections, not an attribution claim.

Data built 2026-10-11 05:00 UTC · rebuilt daily

Recent Confidence Size
Screenshot of roblox.com.bn
Roblox
6103d8e3eab3
same IP · 3/3 members Sep 25, 2026 → Sep 26, 2026
60% suspected cluster
3 domains · 3 hosts · 3 active
Screenshot of correosccl.cc
Correos
0a12ee5e7e96
same screenshot · 4/4 members Sep 1, 2026 → Sep 23, 2026
55% suspected cluster
4 domains · 4 hosts · 4 active
Screenshot of google1208.com
Google
ac8520eb2371
similar name · 3/3 members Aug 1, 2026 → Aug 12, 2026
56% suspected cluster
3 domains · 3 hosts · 3 active
Screenshot of business-dropbox.me
Dropbox, LinkedIn, Microsoft
555474fbaa6d
same favicon · 7/7 members Apr 16, 2026 → Aug 11, 2026
44% suspected cluster
7 domains · 7 hosts · 7 active
Screenshot of binanceaa.com
Binance
1285296f1ed2
same IP · 3/3 members May 20, 2026
87% possible campaign
3 domains · 3 hosts · 3 active

Same data as JSON: /api/v1/campaigns

Recently dissolved
apple 2026-10-06 ledger 2026-10-02 ledger 2026-10-02 allegro 2026-10-02 apple 2026-10-01 binance 2026-09-30 roblox 2026-09-28 spotify 2026-09-25 roblox 2026-09-24 allegro 2026-09-24

A campaign dissolves when none of its indicators are in the active feed any more. Its key is derived from the exact member set, so only an essentially identical set of members revives the same identifier; a merged or split campaign instead continues under its successor's key.

Browse all archived campaigns →

Methodology & provenance
Generated
2026-10-11 05:00 UTC
Algorithm
corr-1.4.0
Input rows
783
Candidate pairs
27163
Edges written
205
Clusters written
5
Runtime
40.3s

Shared infrastructure excluded from clustering: 11 apex domains, 1 TLS cert fingerprints, 1 favicon hashes, 1 redirect targets, 8 IPs, 2 nameserver sets, 15 TLS SAN entries.