Campaigns

Suspected cluster 77b3651e5e31ACTIVE

BetaShared-infrastructure grouping of public detections. Not an attribution claim.

Indicators

Active

Brands

First seen

Aug 24, 2026

Most recent detection

Aug 24, 2026

What these pages look like

Indicators

Domain	Brand	Score	Sources	Match	Status	First seen
1roblox.com.bi	Roblox	03131	OpenPhish	05959	ACTIVE	2026-08-24
2roblox.com.bn	Roblox	03131	OpenPhish	05959	ACTIVE	2026-08-24
3roblox.com.gr	Roblox	03131	OpenPhish	05959	ACTIVE	2026-08-24
4roblox.com.et	Roblox	03131	OpenPhish	04646	ACTIVE	2026-08-24

Why this confidence

56% suspected cluster

Link strength 52%

Evidence diversity 50%

Time compactness 100%

Strong-link share 0%

Size discount 100%

confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.

Evidence summary

4/4 same IP 179.43.172.109

4/4 same favicon c7873c7832b39c98

4/4 same nameservers abby.ns.cloudflare.com,lamar.ns.cloudflare.com

4/4 appeared together (24h) 0.0h

3/4 same screenshot 9d0e0e0e1e1e1f1f~9d0e0e0e1e1e1f1f d=0

Brands targeted

Roblox (4)

Timeline (first seen)

Aug 24 4

History

2026-08-25 shrank -1 members, now 4

2026-08-23 created first tracked with 5 indicators

Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.

How the members connect

	1	2	3	4
1		59	59	46
2	59		59	46
3	59	59		46
4	46	46	46

Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
6 of 6 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.

Relationships

roblox.com.bi ↔ roblox.com.bn 59 first reproduced 2026-08-23

roblox.com.bi roblox.com.bn

Signal	Category	Contributed	IDF
same IP	infra	17.6	×0.80
same screenshot	visual	12.8	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

same ASN	infra	-	same_ip
same hosting org	infra	-	same_ip
similar colors	visual	-	screenshot_phash

roblox.com.bi ↔ roblox.com.gr 59 first reproduced 2026-08-23

roblox.com.bi roblox.com.gr

Signal	Category	Contributed	IDF
same IP	infra	17.6	×0.80
same screenshot	visual	12.8	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

same ASN	infra	-	same_ip
same hosting org	infra	-	same_ip
similar colors	visual	-	screenshot_phash

roblox.com.bn ↔ roblox.com.gr 59 first reproduced 2026-08-23

roblox.com.bn roblox.com.gr

Signal	Category	Contributed	IDF
same IP	infra	17.6	×0.80
same screenshot	visual	12.8	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

same ASN	infra	-	same_ip
same hosting org	infra	-	same_ip
similar colors	visual	-	screenshot_phash

roblox.com.bi ↔ roblox.com.et 46 first reproduced 2026-08-23

roblox.com.bi roblox.com.et

Signal	Category	Contributed	IDF
same IP	infra	17.6	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

same ASN	infra	0.0	-	same_ip
same hosting org	infra	0.0	-	same_ip

roblox.com.bn ↔ roblox.com.et 46 first reproduced 2026-08-23

roblox.com.bn roblox.com.et

Signal	Category	Contributed	IDF
same IP	infra	17.6	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

same ASN	infra	0.0	-	same_ip
same hosting org	infra	0.0	-	same_ip

roblox.com.et ↔ roblox.com.gr 46 first reproduced 2026-08-23

roblox.com.et roblox.com.gr

Signal	Category	Contributed	IDF
same IP	infra	17.6	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

same ASN	infra	0.0	-	same_ip
same hosting org	infra	0.0	-	same_ip

Infrastructure footprint

IP addresses

179.43.172.109 4/4

ASNs

51852 4/4

Hosting orgs

Private Layer INC 4/4

TLS certs

YR1 3/4

YR2 1/4

Export JSON CSV TXT

corr-1.2.0 · built 2026-08-28 05:00 UTC - rebuilt daily