Possible campaign 0c08ddef2f4eACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
33 hostsActive
3Brands
1First seen
Sep 18, 2026Most recent detection
Sep 19, 2026 What these pages look like
Indicators
roblox.com.do Why this confidence
82%
possible campaign
Link strength
74%
Evidence diversity
75%
Time compactness
99%
Strong-link share
100%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same TLS cert
80d087a3e04300e595502c534c57aff5a85735af4c2d0a6e4bee85be19e5c06a
3/3
same favicon
86cd297867359d91
3/3
same nameservers
gannon.ns.cloudflare.com,vivienne.ns.cloudflare.com
3/3
appeared together (24h)
12.0h
Brands targeted
Timeline (first seen)
Sep 18
2
Sep 19
1
History
2026-09-07
created
first tracked with 3 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | 81 | 70 | |
| 2 | 81 | 70 | |
| 3 | 70 | 70 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
3 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
roblox.com.do ↔ roblox.com.ml 81 first reproduced 2026-09-19
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same TLS cert | tls | 17.1 | - | |
| same screenshot | visual | 13.3 | - | |
| same nameservers | infra | 11.7 | - | |
| same favicon | visual | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| certs issued together | tls | 2.9 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| shared TLS SAN | tls | 0.0 | - | cert_fingerprint_exact |
| similar colors | visual | 0.0 | - | screenshot_phash |
roblox.com.am ↔ roblox.com.do 70 first reproduced 2026-09-19
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same TLS cert | tls | 17.1 | - | |
| same favicon | visual | 14.0 | - | |
| same nameservers | infra | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| certs issued together | tls | 2.9 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| shared TLS SAN | tls | 0.0 | - | cert_fingerprint_exact |
roblox.com.am ↔ roblox.com.ml 70 first reproduced 2026-09-19
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same TLS cert | tls | 17.1 | - | |
| same favicon | visual | 14.0 | - | |
| same nameservers | infra | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| certs issued together | tls | 2.9 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| shared TLS SAN | tls | 0.0 | - | cert_fingerprint_exact |
Infrastructure footprint
IP addresses
31.56.209.148
3/3
ASNs
209373
3/3
Hosting orgs
SWISSNET LLC
3/3
Registrars
AGETIC Registrar
1/3
TLS certs
YE2
3/3