Possible campaign 553b4d5d6d60ACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
33 hostsActive
3Brands
1First seen
Oct 31, 2026Most recent detection
Oct 31, 2026 What these pages look like
Indicators
coinbaseprolnb.com Why this confidence
86%
possible campaign
Link strength
69%
Evidence diversity
100%
Time compactness
100%
Strong-link share
100%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same nameservers
carlane.ns.cloudflare.com,tim.ns.cloudflare.com
3/3
same screenshot
885d764cccc6d999~8859774cccc6d999 d=2
3/3
same favicon
c59b1a6d709265d6
3/3
appeared together (24h)
0.2h
3/3
registered together
0d/0d
Brands targeted
Timeline (first seen)
Oct 31
3
History
2026-11-01
created
first tracked with 3 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | 69 | 69 | |
| 2 | 69 | 69 | |
| 3 | 69 | 69 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
3 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
coinbaseprolnb.com ↔ coinbaseprolng.com 69 first reproduced 2026-11-01
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same nameservers | infra | 14.0 | - | |
| same screenshot | visual | 13.3 | - | |
| similar name | naming | 12 | - | |
| same favicon | visual | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
coinbaseprolnb.com ↔ coinbaseprolns.com 69 first reproduced 2026-11-01
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same nameservers | infra | 14.0 | - | |
| same screenshot | visual | 13.3 | - | |
| similar name | naming | 12 | - | |
| same favicon | visual | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 3 | - |
coinbaseprolng.com ↔ coinbaseprolns.com 69 first reproduced 2026-11-01
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same nameservers | infra | 14.0 | - | |
| same screenshot | visual | 13.3 | - | |
| similar name | naming | 12 | - | |
| same favicon | visual | 11.7 | - | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 3 | - |
Infrastructure footprint