Campaigns

Suspected cluster 1dedcfa35d5aACTIVE

BetaShared-infrastructure grouping of public detections. Not an attribution claim.

Indicators

Active

Brands

First seen

May 22

Last activity

Jul 28

What these pages look like

security-help-microsoft.com

securityhelp-microsoft.com

helpsecurity-microsoft.com

icloudnets.com

securedsupport-coinbase.com

helpscontact-coinbase.com

Why this confidence

53% suspected cluster

Link strength 22%

Evidence diversity 100%

Time compactness 75%

Strong-link share 33%

Size discount 100%

confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.

Evidence summary

6/6 same favicon cc91196f0e4a5b5b

6/6 same asn 53831

6/6 same registrar Squarespace Domains II LLC

4/6 registered together 10d/9d

4/6 same IP 198.49.23.144

Brands targeted

Microsoft (3) Coinbase (2) Apple (1)

Timeline (first seen)

Spread over 67 days

May 22 1

Jul 07 1

Jul 27 3

Jul 28 1

History

2026-07-29 grew +1 members, now 6

2026-07-28 created first tracked with 5 indicators

Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.

How the members connect

	1	2	3	4	5	6
1		69	44	54	33	46
2	69		66	42	33	46
3	44	66		29	50	33
4	54	42	29		20	33
5	33	33	50	20		33
6	46	46	33	33	33

Each cell is the relationship score between two members, numbered as in the Indicators table below. Hover a cell for the domains and the signals behind it.
15 of 15 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.

Infrastructure footprint

IP addresses

198.49.23.144 4/6

198.185.159.144 2/6

ASNs

53831 6/6

Hosting orgs

Squarespace, Inc. 6/6

Registrars

Squarespace Domains II LLC 6/6

TLS certs

Let's Encrypt 2/6

Indicators

Domain	Brand	Score	Sources	Match	Status	First seen
1security-help-microsoft.com	Microsoft	02626	TweetFeed	06969	ACTIVE	2026-07-27
2securityhelp-microsoft.com	Microsoft	02525	TweetFeed	06969	ACTIVE	2026-07-27
3helpsecurity-microsoft.com	Microsoft	02323	TweetFeed	06666	ACTIVE	2026-07-27
4icloudnets.com	Apple	02525	TweetFeed	05454	ACTIVE	2026-07-28
5securedsupport-coinbase.com	Coinbase	02222	urlscan	05050	ACTIVE	2026-07-07
6helpscontact-coinbase.com	Coinbase	02626	urlscan	04646	ACTIVE	2026-05-22

Export JSON CSV TXT

corr-1.2.0 - rebuilt daily

	1	2	3	4	5	6
1		69	44	54	33	46
2	69		66	42	33	46
3	44	66		29	50	33
4	54	42	29		20	33
5	33	33	50	20		33
6	46	46	33	33	33

	1	2	3	4	5	6
1		69	44	54	33	46
2	69		66	42	33	46
3	44	66		29	50	33
4	54	42	29		20	33
5	33	33	50	20		33
6	46	46	33	33	33

	1	2	3	4	5	6
1		69	44	54	33	46
2	69		66	42	33	46
3	44	66		29	50	33
4	54	42	29		20	33
5	33	33	50	20		33
6	46	46	33	33	33