Suspected cluster 46128c71fd93ACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
33 hostsActive
3Brands
1First seen
Oct 22, 2026Most recent detection
Oct 25, 2026 What these pages look like
Indicators
fedexi.cc Why this confidence
66%
suspected cluster
Link strength
49%
Evidence diversity
100%
Time compactness
95%
Strong-link share
0%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same nameservers
isabel.ns.cloudflare.com,jose.ns.cloudflare.com
3/3
registered together
0d/2d
3/3
certs issued together
0d/2d
2/3
same screenshot
edb5526d154a1336~edb5526d156a1332 d=2
Brands targeted
Timeline (first seen)
Spread over 3 days
Oct 22
1
Oct 23
1
Oct 25
1
History
2026-10-26
created
first tracked with 3 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | 54 | 46 | |
| 2 | 54 | 46 | |
| 3 | 46 | 46 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
3 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
fedexi.cc ↔ fedexmxx.cc 54 first reproduced 2026-10-24
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 16.0 | - | |
| same nameservers | infra | 14.0 | - | |
| similar text | content | 6.0 | - | screenshot_phash |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
fedexi.cc ↔ fedexoi.cc 46 first reproduced 2026-10-26
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 16.0 | - | |
| same nameservers | infra | 14.0 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
fedexmxx.cc ↔ fedexoi.cc 46 first reproduced 2026-10-26
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 16.0 | - | |
| same nameservers | infra | 14.0 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
Infrastructure footprint