Archived campaign 1dedcfa35d5aNot live
Shared-infrastructure grouping of public detections. Not an attribution claim.
This campaign is no longer live. What follows is its last recorded state, from 2026-08-30.
Its members dropped out of the active feed. Its identifier is derived from the exact member set, so only an essentially identical set of members would revive it.
Members
3Confidence
51%First tracked
2026-07-28Last seen
2026-08-30Since corr-1.3.0, hostnames under one registrable domain count as one member; earlier snapshots counted hostnames.
Last recorded indicators
helpsecurity-microsoft.com
securedsupport-coinbase.com
xfinitywindowfilms.com
History
2026-08-30
dissolved
no members left in the active feed
2026-08-27
shrank
-1 host, now 3 members
2026-08-26
shrank
-1 host, now 4 members
2026-08-25
shrank
-2 hosts, now 5 members
2026-08-24
grew
+3 hosts, now 7 members
2026-08-16
shrank
-1 host, now 4 members
2026-08-04
shrank
-1 host, now 5 members
2026-07-29
grew
+1 host, now 6 members
2026-07-28
created
first tracked with 5 members
History is kept for 180 days after the last rebuild that saw this campaign.