Suspected cluster 72f66562793cACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
99 hostsActive
9Brands
1First seen
Nov 09, 2026Most recent detection
Nov 12, 2026 What these pages look like
Indicators
allegrolokalnie.o5433443.top
allegrolokalnie.nr-238sn34.sbs Why this confidence
59%
suspected cluster
Link strength
28%
Evidence diversity
100%
Time compactness
98%
Strong-link share
16%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
9/9
same favicon
93b2394c6c365b1b
8/9
certs issued together
0d/0d
6/9
same screenshot
f3324e4b136b0c6b~f3324e4b136b0c6b d=0
6/9
similar name
allegrolokalnie~allegrolokalnie d=0
Brands targeted
Timeline (first seen)
Spread over 3 days
Nov 09
1
Nov 11
4
Nov 12
4
History
2026-11-13
created
first tracked with 9 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | 63 | 62 | 48 | 58 | 44 | 54 | 49 | 35 | |
| 2 | 63 | 60 | 48 | 58 | 42 | 48 | 47 | 29 | |
| 3 | 62 | 60 | 51 | 57 | 41 | 47 | 50 | 28 | |
| 4 | 48 | 48 | 51 | 59 | 43 | 48 | 38 | 29 | |
| 5 | 58 | 58 | 57 | 59 | 58 | 43 | 44 | 24 | |
| 6 | 44 | 42 | 41 | 43 | 58 | 29 | 44 | 36 | |
| 7 | 54 | 48 | 47 | 48 | 43 | 29 | 34 | 49 | |
| 8 | 49 | 47 | 50 | 38 | 44 | 44 | 34 | 31 | |
| 9 | 35 | 29 | 28 | 29 | 24 | 36 | 49 | 31 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
19 of 36 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member. A greyed-out cell is linked below the clustering threshold or by same-kit similarity - it did not form this cluster.
Relationships
allegrolokalnie.o5433443.top ↔ allegrolokalnie.pl74892.pl 63 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| similar name | naming | 4.4 | ×0.50 | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegrolokalnie.nr-238sn34.sbs ↔ allegrolokalnie.o5433443.top 62 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| similar name | naming | 4.4 | ×0.50 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegrolokalnie.nr-238sn34.sbs ↔ allegrolokalnie.pl74892.pl 60 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| similar name | naming | 4.4 | ×0.50 | |
| appeared together (72h) | temporal | 4 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegro.ofe83204.sbs ↔ allegrolokalnie.o102040.shop 59 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same nameservers | infra | 14.0 | - | |
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegrolokalnie.o102040.shop ↔ allegrolokalnie.o108940.shop 58 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same nameservers | infra | 14.0 | - | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| similar name | naming | 4.4 | ×0.50 | |
| certs issued together | tls | 3 | - | |
| similar colors | visual | 3 | - |
allegrolokalnie.o102040.shop ↔ allegrolokalnie.o5433443.top 58 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| similar name | naming | 4.4 | ×0.50 | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegrolokalnie.o102040.shop ↔ allegrolokalnie.pl74892.pl 58 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| similar name | naming | 4.4 | ×0.50 | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegrolokalnie.nr-238sn34.sbs ↔ allegrolokalnie.o102040.shop 57 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| similar name | naming | 4.4 | ×0.50 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegro.o5413443.top ↔ allegrolokalnie.o5433443.top 54 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegro.ofe83204.sbs ↔ allegrolokalnie.nr-238sn34.sbs 51 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegrolokalnie.nr-238sn34.sbs ↔ allegrolokalnie.smart-92492.cfd 50 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| similar name | naming | 4.4 | ×0.50 | |
| same registrar | registration | 4 | - | |
| similar colors | visual | 3 | - |
allegro.o5413443.top ↔ allegro.o54134483.top 49 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same nameservers | infra | 14.0 | - | |
| same favicon | visual | 11.2 | ×0.80 | |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same registrar | registration | 4 | - | |
| certs issued together | tls | 3 | - |
allegrolokalnie.o5433443.top ↔ allegrolokalnie.smart-92492.cfd 49 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| similar name | naming | 4.4 | ×0.50 | |
| certs issued together | tls | 3 | - | |
| similar colors | visual | 3 | - |
allegro.o5413443.top ↔ allegro.ofe83204.sbs 48 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegro.o5413443.top ↔ allegrolokalnie.pl74892.pl 48 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegro.ofe83204.sbs ↔ allegrolokalnie.o5433443.top 48 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegro.ofe83204.sbs ↔ allegrolokalnie.pl74892.pl 48 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
allegrolokalnie.pl74892.pl ↔ allegrolokalnie.smart-92492.cfd 47 first reproduced 2026-11-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same favicon | visual | 11.2 | ×0.80 | |
| similar name | naming | 10.6 | - | |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| similar name | naming | 4.4 | ×0.50 | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - | |
| similar colors | visual | 3 | - |
allegro.o5413443.top ↔ allegrolokalnie.nr-238sn34.sbs 47 first reproduced 2026-11-13
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 12.8 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
Infrastructure footprint
IP addresses
188.114.96.3
2/9
172.67.183.110
1/9
2.59.219.224
1/9
104.21.83.74
1/9
104.21.60.189
1/9