Possible campaigns

Beta14 live campaigns grouping 64 indicators across 13 brands, rebuilt daily. Shared-infrastructure grouping of public detections, not an attribution claim.

Data built 2026-08-30 05:00 UTC · rebuilt daily

Recent Confidence Size

5 new in the last 7 days

Ledger, TrezorNew

same TLS cert · 4/4 members Aug 28, 2026 → Aug 30, 2026

59% suspected cluster

4 indicators · 4 active

same favicon · 14/14 members Aug 22, 2026 → Aug 29, 2026

54% suspected cluster

14 indicators · 14 active

Citrix, Coinbase, MicrosoftNew

same screenshot · 3/3 members Aug 9, 2026 → Aug 27, 2026

63% suspected cluster

3 indicators · 3 active

same IP · 4/4 members Aug 24, 2026

56% suspected cluster

4 indicators · 4 active

same screenshot · 3/3 members Aug 22, 2026

86% possible campaign

3 indicators · 3 active

similar name · 3/3 members Aug 1, 2026 → Aug 12, 2026

56% suspected cluster

3 indicators · 3 active

Banco Santander

same IP · 6/6 members Aug 5, 2026 → Aug 8, 2026

83% possible campaign

6 indicators · 6 active

same screenshot · 8/8 members Jul 11, 2026 → Jul 12, 2026

75% possible campaign

8 indicators · 8 active

same TLS cert · 3/3 members Mar 28, 2026 → Jun 8, 2026

60% suspected cluster

3 indicators · 3 active

same IP · 3/3 members May 20, 2026

87% possible campaign

3 indicators · 3 active

Microsoft, PayPal

same TLS cert · 3/3 members May 12, 2026 → May 15, 2026

65% suspected cluster

3 indicators · 3 active

same screenshot · 3/3 members Apr 6, 2026 → Apr 12, 2026

88% possible campaign

3 indicators · 3 active

same TLS cert · 4/4 members Apr 6, 2026

79% possible campaign

4 indicators · 4 active

same IP · 3/3 members

66% suspected cluster

3 indicators · 0 active

Recently dissolved

coinbase 2026-08-30 allegro 2026-08-29 ledger 2026-08-29 netflix 2026-08-29 facebook 2026-08-28 allegro 2026-08-28 allegro 2026-08-27 dropbox 2026-08-25 allegro 2026-08-25 dpd 2026-08-25

A campaign dissolves when none of its indicators are in the active feed any more. Its key is derived from the exact member set, so only an essentially identical set of members revives the same identifier; a merged or split campaign instead continues under its successor's key.

Browse all archived campaigns →

Methodology & provenance

Generated: 2026-08-30 05:00 UTC
Algorithm: corr-1.2.0
Input rows: 945
Candidate pairs: 37153
Edges written: 578
Clusters written: 15
Runtime: 19.6s

Shared infrastructure excluded from clustering: 9 apex domains, 1 favicon hashes, 8 IPs, 4 nameserver sets, 9 TLS SAN entries.