Suspected cluster 77b3651e5e31ACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
33 hostsActive
3Brands
1First seen
Aug 24, 2026Most recent detection
Aug 24, 2026 What these pages look like
Indicators
roblox.com.bi
Why this confidence
59%
suspected cluster
Link strength
59%
Evidence diversity
50%
Time compactness
100%
Strong-link share
0%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same screenshot
9d0e0e0e1e1e1f1f~9d0e0e0e1e1e1f1f d=0
3/3
same favicon
c7873c7832b39c98
3/3
same nameservers
abby.ns.cloudflare.com,lamar.ns.cloudflare.com
3/3
appeared together (24h)
0.0h
Brands targeted
Timeline (first seen)
Aug 24
3
History
2026-09-04
shrank
-1 host, now 3 members
2026-08-25
shrank
-1 host, now 4 members
2026-08-23
created
first tracked with 5 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | 59 | 59 | |
| 2 | 59 | 59 | |
| 3 | 59 | 59 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
3 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
roblox.com.bi ↔ roblox.com.bn 59 first reproduced 2026-08-23
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.6 | ×0.80 | |
| same screenshot | visual | 12.8 | ×0.80 | |
| same nameservers | infra | 11.2 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| appeared together (24h) | temporal | 6 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
roblox.com.bi ↔ roblox.com.gr 59 first reproduced 2026-08-23
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.6 | ×0.80 | |
| same screenshot | visual | 12.8 | ×0.80 | |
| same nameservers | infra | 11.2 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| appeared together (24h) | temporal | 6 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| similar colors | visual | 0.0 | - | screenshot_phash |
roblox.com.bn ↔ roblox.com.gr 59 first reproduced 2026-08-23
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.6 | ×0.80 | |
| same screenshot | visual | 12.8 | ×0.80 | |
| same nameservers | infra | 11.2 | ×0.80 | |
| same favicon | visual | 11.2 | ×0.80 | |
| appeared together (24h) | temporal | 6 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
Infrastructure footprint