Possible campaign 3e2155b37baeACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
33 hostsActive
3Brands
1First seen
Oct 17, 2026Most recent detection
Oct 17, 2026 What these pages look like
Indicators
googles6yf.com Why this confidence
79%
possible campaign
Link strength
61%
Evidence diversity
100%
Time compactness
99%
Strong-link share
67%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same screenshot
b171717171717171~b171717171717171 d=0
3/3
same nameservers
ns1.abovedomains.com,ns2.abovedomains.com
3/3
similar name
aaaaaaa9aa
3/3
appeared together (24h)
6.0h
3/3
same ASN
133618
Brands targeted
Timeline (first seen)
Oct 17
3
History
2026-10-18
created
first tracked with 3 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | 69 | 52 | |
| 2 | 69 | 63 | |
| 3 | 52 | 63 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
3 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
googles6yf.com ↔ googlet0np.com 69 first reproduced 2026-10-18
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same TLS cert | tls | 17.1 | - | |
| same screenshot | visual | 16.0 | - | |
| same nameservers | infra | 14.0 | - | |
| similar name | naming | 8 | - | |
| appeared together (24h) | temporal | 6 | - | |
| same ASN | infra | 5 | - | |
| certs issued together | tls | 2.9 | - |
Discounted observations
| same hosting org | infra | 0.0 | - | same_asn |
| shared TLS SAN | tls | 0.0 | - | cert_fingerprint_exact |
| similar colors | visual | 0.0 | - | screenshot_phash |
googlet0np.com ↔ googley8rb.com 63 first reproduced 2026-10-18
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same screenshot | visual | 16.0 | - | |
| same nameservers | infra | 11.7 | - | |
| similar name | naming | 8 | - | |
| appeared together (24h) | temporal | 6 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| similar colors | visual | 0.0 | - | screenshot_phash |
googles6yf.com ↔ googley8rb.com 52 first reproduced 2026-10-18
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 16.0 | - | |
| same nameservers | infra | 14.0 | - | |
| similar name | naming | 8 | - | |
| appeared together (24h) | temporal | 6 | - | |
| same ASN | infra | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| same hosting org | infra | 0.0 | - | same_asn |
| similar colors | visual | 0.0 | - | screenshot_phash |
Infrastructure footprint