Campaigns
Suspected cluster 6103d8e3eab3ACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Most recent detection
Sep 26, 2026
What these pages look like
Why this confidence
60%
suspected cluster
Link strength
48%
Evidence diversity
75%
Time compactness
97%
Strong-link share
0%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
4/4
same favicon
c7873c7832b39c98
4/4
same nameservers
abby.ns.cloudflare.com,lamar.ns.cloudflare.com
4/4
appeared together (24h)
0.0h
4/4
appeared together (72h)
36.0h
History
2026-09-27
created
first tracked with 4 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
|
1 | 2 | 3 | 4 |
| 1 |
|
50 |
49 |
47 |
| 2 |
50 |
|
47 |
49 |
| 3 |
49 |
47 |
|
47 |
| 4 |
47 |
49 |
47 |
|
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
6 of 6 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
roblox.com.bi ↔ roblox.com.bn
50
first reproduced 2026-09-27
| Signal | Category | Contributed | IDF | Notes |
|---|
| same IP |
infra |
17.6 |
×0.80 |
|
| same nameservers |
infra |
11.2 |
×0.80 |
|
| same favicon |
visual |
11.2 |
×0.80 |
|
| appeared together (72h) |
temporal |
4 |
- |
|
| certs issued together |
tls |
3 |
- |
|
| similar colors |
visual |
3 |
- |
|
Discounted observations
| same ASN |
infra |
0.0 |
- |
same_ip |
| same hosting org |
infra |
0.0 |
- |
same_ip |
roblox.com.bi ↔ roblox.com.gr
49
first reproduced 2026-09-25
| Signal | Category | Contributed | IDF | Notes |
|---|
| same IP |
infra |
17.6 |
×0.80 |
|
| same nameservers |
infra |
11.2 |
×0.80 |
|
| same favicon |
visual |
11.2 |
×0.80 |
|
| appeared together (24h) |
temporal |
6 |
- |
|
| certs issued together |
tls |
3 |
- |
|
Discounted observations
| same ASN |
infra |
0.0 |
- |
same_ip |
| same hosting org |
infra |
0.0 |
- |
same_ip |
roblox.com.bn ↔ roblox.com.pt
49
first reproduced 2026-09-27
| Signal | Category | Contributed | IDF | Notes |
|---|
| same IP |
infra |
17.6 |
×0.80 |
|
| same nameservers |
infra |
11.2 |
×0.80 |
|
| same favicon |
visual |
11.2 |
×0.80 |
|
| appeared together (24h) |
temporal |
6 |
- |
|
| certs issued together |
tls |
3 |
- |
|
Discounted observations
| same ASN |
infra |
0.0 |
- |
same_ip |
| same hosting org |
infra |
0.0 |
- |
same_ip |
roblox.com.bi ↔ roblox.com.pt
47
first reproduced 2026-09-27
| Signal | Category | Contributed | IDF | Notes |
|---|
| same IP |
infra |
17.6 |
×0.80 |
|
| same nameservers |
infra |
11.2 |
×0.80 |
|
| same favicon |
visual |
11.2 |
×0.80 |
|
| appeared together (72h) |
temporal |
4 |
- |
|
| certs issued together |
tls |
3 |
- |
|
Discounted observations
| same ASN |
infra |
0.0 |
- |
same_ip |
| same hosting org |
infra |
0.0 |
- |
same_ip |
roblox.com.bn ↔ roblox.com.gr
47
first reproduced 2026-09-27
| Signal | Category | Contributed | IDF | Notes |
|---|
| same IP |
infra |
17.6 |
×0.80 |
|
| same nameservers |
infra |
11.2 |
×0.80 |
|
| same favicon |
visual |
11.2 |
×0.80 |
|
| appeared together (72h) |
temporal |
4 |
- |
|
| certs issued together |
tls |
3 |
- |
|
Discounted observations
| same ASN |
infra |
0.0 |
- |
same_ip |
| same hosting org |
infra |
0.0 |
- |
same_ip |
roblox.com.gr ↔ roblox.com.pt
47
first reproduced 2026-09-27
| Signal | Category | Contributed | IDF | Notes |
|---|
| same IP |
infra |
17.6 |
×0.80 |
|
| same nameservers |
infra |
11.2 |
×0.80 |
|
| same favicon |
visual |
11.2 |
×0.80 |
|
| appeared together (72h) |
temporal |
4 |
- |
|
| certs issued together |
tls |
3 |
- |
|
Discounted observations
| same ASN |
infra |
0.0 |
- |
same_ip |
| same hosting org |
infra |
0.0 |
- |
same_ip |
corr-1.3.0 · built 2026-10-01 05:00 UTC - rebuilt daily
roblox.com.bi