Possible campaign 1285296f1ed2ACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Indicators
3Active
3Brands
1First seen
May 20, 2026Most recent detection
May 20, 2026 What these pages look like
Indicators
binanceaa.com Why this confidence
87%
possible campaign
Link strength
72%
Evidence diversity
100%
Time compactness
100%
Strong-link share
100%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same TLS cert
0d2dd02082afc58d0ae8bcb4ad12dac973018ba7df543e5c68e0cfcc81fadcea
3/3
same nameservers
ns1.julydns.com,ns2.julydns.com
3/3
appeared together (24h)
0.0h
Brands targeted
Timeline (first seen)
May 20
3
History
2026-07-18
created
first tracked with 3 indicators
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | 72 | 72 | |
| 2 | 72 | 72 | |
| 3 | 72 | 72 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
3 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
binanceaa.com ↔ binanceii.com 72 first reproduced 2026-07-18
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same TLS cert | tls | 17.1 | - | |
| similar name | naming | 12 | - | |
| same nameservers | infra | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 2.9 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| shared TLS SAN | tls | 0.0 | - | cert_fingerprint_exact |
| similar colors | visual | 0.0 | - | no_corroborating_signal |
binanceaa.com ↔ binancenn.com 72 first reproduced 2026-07-18
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same TLS cert | tls | 17.1 | - | |
| similar name | naming | 12 | - | |
| same nameservers | infra | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 2.9 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| shared TLS SAN | tls | 0.0 | - | cert_fingerprint_exact |
| similar colors | visual | 0.0 | - | no_corroborating_signal |
binanceii.com ↔ binancenn.com 72 first reproduced 2026-07-18
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same TLS cert | tls | 17.1 | - | |
| similar name | naming | 12 | - | |
| same nameservers | infra | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 2.9 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| shared TLS SAN | tls | 0.0 | - | cert_fingerprint_exact |
| similar colors | visual | 0.0 | - | no_corroborating_signal |
Infrastructure footprint