Campaigns

Suspected cluster 9861f3cf7b97ACTIVE

BetaShared-infrastructure grouping of public detections. Not an attribution claim.

Indicators

Active

Brands

First seen

Aug 22, 2026

Most recent detection

Aug 25, 2026

What these pages look like

allegro.ploferta3217832819.sbs

allegrolokalnie.ploferta3217832819.sbs

allegro.ploferta23189192.rest

allegrolokalnie.ploferta23189192.rest

allegrolokalnie.lokalna-ofeta92112.cfd

allegrolokalnie.lokalna-948271.sbs

allegrolokalnie.oferta-lokalana694502304235.lol

allegrolokalnie.pl-dpd24.pl

allegrolokalnie.oferta-lokalna8654968923445.shop

allegro.pi-ofeta089139.shop

Indicators

Domain	Brand	Score	Sources	Match	Status	First seen
1allegro.ploferta3217832819.sbs	Allegro	04949	GSBPhishTankTweetFeed	100100	ACTIVE	2026-08-24
2allegrolokalnie.ploferta3217832819.sbs	Allegro	04646	GSBPhishTankTweetFeed	100100	ACTIVE	2026-08-24
3allegro.ploferta23189192.rest	Allegro	03939	PhishTank	08686	ACTIVE	2026-08-24
4allegrolokalnie.ploferta23189192.rest	Allegro	03636	PhishTank	08686	ACTIVE	2026-08-24
5allegrolokalnie.lokalna-ofeta92112.cfd	Allegro	03939	PhishTank	07474	ACTIVE	2026-08-24
6allegrolokalnie.lokalna-948271.sbs	Allegro	03636	PhishTank	07373	ACTIVE	2026-08-24
7allegrolokalnie.oferta-lokalana694502304235.lol	Allegro	03535	PhishTank	07373	ACTIVE	2026-08-25
8allegrolokalnie.pl-dpd24.pl	DPD	03636	GSBPhishTank	06969	ACTIVE	2026-08-24
9allegrolokalnie.oferta-lokalna8654968923445.shop	Allegro	02929	PhishTank	06060	ACTIVE	2026-08-22
10allegro.pi-ofeta089139.shop	Allegro	03232	PhishTank	04747	ACTIVE	2026-08-22

Why this confidence

66% suspected cluster

Link strength 38%

Evidence diversity 100%

Time compactness 99%

Strong-link share 43%

Size discount 100%

confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.

Evidence summary

10/10 same favicon 93b2394c6c365b1b

10/10 same redirect target allegrolokalnie.pl

8/10 similar text jaccard=1.00

7/10 similar name allegrolokalnie~allegrolokalnie d=0

7/10 similar name allegrolokalnie

Brands targeted

Allegro (9) DPD (1)

Timeline (first seen)

Spread over 3 days

Aug 22 2

Aug 24 7

Aug 25 1

History

2026-08-25 created first tracked with 10 indicators

Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.

How the members connect

	1	2	3	4	5	6	7	8	9	10
1		100	66	47	36	55	55	54	25	25
2	100		66	62	51	70	70	69	40	25
3	66	66		86	39	58	58	46	25	25
4	47	62	86		74	54	54	42	60	45
5	36	51	39	74		54	54	42	60	45
6	55	70	58	54	54		73	61	40	25
7	55	70	58	54	54	73		61	54	25
8	54	69	46	42	42	61	61		40	28
9	25	40	25	60	60	40	54	40		47
10	25	25	25	45	45	25	25	28	47

Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
28 of 45 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member. A greyed-out cell is linked below the clustering threshold or by same-kit similarity - it did not form this cluster.

Relationships

allegro.ploferta3217832819.sbs ↔ allegrolokalnie.ploferta3217832819.sbs 100 first reproduced 2026-08-25

allegro.ploferta3217832819.sbs allegrolokalnie.ploferta3217832819.sbs

Signal	Category	Contributed	IDF	Notes
same TLS cert	tls	16.3	-
same screenshot	visual	12.2	×0.80
same favicon	visual	10.7	×0.80
same nameservers	infra	10.4	×0.80
similar name	naming	9.4	-
same apex	infra	9.2	-
same redirect target	infra	9.0	×0.80
similar text	content	5.7	-	screenshot_phash
appeared together (24h)	temporal	5.7	-
registered together	registration	4.8	-
same registrar	registration	3.8	-
certs issued together	tls	2.8	-

Discounted observations

shared TLS SAN	tls	0.0	-	cert_fingerprint_exact
similar colors	visual	0.0	-	screenshot_phash

allegro.ploferta23189192.rest ↔ allegrolokalnie.ploferta23189192.rest 86 first reproduced 2026-08-25

allegro.ploferta23189192.rest allegrolokalnie.ploferta23189192.rest

Signal	Category	Contributed	IDF
same TLS cert	tls	17.1	-
same favicon	visual	11.2	×0.80
same nameservers	infra	10.9	×0.80
similar name	naming	10.0	-
same apex	infra	9.7	-
same redirect target	infra	9.4	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	2.9	-

Discounted observations

shared TLS SAN

tls

0.0

cert_fingerprint_exact

allegrolokalnie.lokalna-ofeta92112.cfd ↔ allegrolokalnie.ploferta23189192.rest 74 first reproduced 2026-08-25

allegrolokalnie.lokalna-ofeta92112.cfd allegrolokalnie.ploferta23189192.rest

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	14.7	-
same favicon	visual	10.3	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.lokalna-948271.sbs ↔ allegrolokalnie.oferta-lokalana694502304235.lol 73 first reproduced 2026-08-25

allegrolokalnie.lokalna-948271.sbs allegrolokalnie.oferta-lokalana694502304235.lol

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.lokalna-948271.sbs ↔ allegrolokalnie.ploferta3217832819.sbs 70 first reproduced 2026-08-25

allegrolokalnie.lokalna-948271.sbs allegrolokalnie.ploferta3217832819.sbs

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.oferta-lokalana694502304235.lol ↔ allegrolokalnie.ploferta3217832819.sbs 70 first reproduced 2026-08-25

allegrolokalnie.oferta-lokalana694502304235.lol allegrolokalnie.ploferta3217832819.sbs

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.pl-dpd24.pl ↔ allegrolokalnie.ploferta3217832819.sbs 69 first reproduced 2026-08-25

allegrolokalnie.pl-dpd24.pl allegrolokalnie.ploferta3217832819.sbs

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
certs issued together	tls	3	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegro.ploferta23189192.rest ↔ allegro.ploferta3217832819.sbs 66 first reproduced 2026-08-25

allegro.ploferta23189192.rest allegro.ploferta3217832819.sbs

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegro.ploferta23189192.rest ↔ allegrolokalnie.ploferta3217832819.sbs 66 first reproduced 2026-08-25

allegro.ploferta23189192.rest allegrolokalnie.ploferta3217832819.sbs

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.ploferta23189192.rest ↔ allegrolokalnie.ploferta3217832819.sbs 62 first reproduced 2026-08-25

allegrolokalnie.ploferta23189192.rest allegrolokalnie.ploferta3217832819.sbs

Signal	Category	Contributed	IDF
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

allegrolokalnie.lokalna-948271.sbs ↔ allegrolokalnie.pl-dpd24.pl 61 first reproduced 2026-08-25

allegrolokalnie.lokalna-948271.sbs allegrolokalnie.pl-dpd24.pl

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.oferta-lokalana694502304235.lol ↔ allegrolokalnie.pl-dpd24.pl 61 first reproduced 2026-08-25

allegrolokalnie.oferta-lokalana694502304235.lol allegrolokalnie.pl-dpd24.pl

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.lokalna-ofeta92112.cfd ↔ allegrolokalnie.oferta-lokalna8654968923445.shop 60 first reproduced 2026-08-25

allegrolokalnie.lokalna-ofeta92112.cfd allegrolokalnie.oferta-lokalna8654968923445.shop

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	14.7	-
same favicon	visual	10.3	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (72h)	temporal	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.oferta-lokalna8654968923445.shop ↔ allegrolokalnie.ploferta23189192.rest 60 first reproduced 2026-08-25

allegrolokalnie.oferta-lokalna8654968923445.shop allegrolokalnie.ploferta23189192.rest

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	14.7	-
same favicon	visual	10.3	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar text	content	6.0	-	screenshot_phash
similar name	naming	6.0	×0.80
appeared together (72h)	temporal	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegro.ploferta23189192.rest ↔ allegrolokalnie.lokalna-948271.sbs 58 first reproduced 2026-08-25

allegro.ploferta23189192.rest allegrolokalnie.lokalna-948271.sbs

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegro.ploferta23189192.rest ↔ allegrolokalnie.oferta-lokalana694502304235.lol 58 first reproduced 2026-08-25

allegro.ploferta23189192.rest allegrolokalnie.oferta-lokalana694502304235.lol

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegro.ploferta3217832819.sbs ↔ allegrolokalnie.lokalna-948271.sbs 55 first reproduced 2026-08-25

allegro.ploferta3217832819.sbs allegrolokalnie.lokalna-948271.sbs

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegro.ploferta3217832819.sbs ↔ allegrolokalnie.oferta-lokalana694502304235.lol 55 first reproduced 2026-08-25

allegro.ploferta3217832819.sbs allegrolokalnie.oferta-lokalana694502304235.lol

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.lokalna-948271.sbs ↔ allegrolokalnie.lokalna-ofeta92112.cfd 54 first reproduced 2026-08-25

allegrolokalnie.lokalna-948271.sbs allegrolokalnie.lokalna-ofeta92112.cfd

Signal	Category	Contributed	IDF
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	8.2	-
similar name	naming	6.8	-
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

allegrolokalnie.lokalna-948271.sbs ↔ allegrolokalnie.ploferta23189192.rest 54 first reproduced 2026-08-25

allegrolokalnie.lokalna-948271.sbs allegrolokalnie.ploferta23189192.rest

Signal	Category	Contributed	IDF
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

allegrolokalnie.lokalna-ofeta92112.cfd ↔ allegrolokalnie.oferta-lokalana694502304235.lol 54 first reproduced 2026-08-25

allegrolokalnie.lokalna-ofeta92112.cfd allegrolokalnie.oferta-lokalana694502304235.lol

Signal	Category	Contributed	IDF
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

allegrolokalnie.oferta-lokalana694502304235.lol ↔ allegrolokalnie.oferta-lokalna8654968923445.shop 54 first reproduced 2026-08-25

allegrolokalnie.oferta-lokalana694502304235.lol allegrolokalnie.oferta-lokalna8654968923445.shop

Signal	Category	Contributed	IDF
same nameservers	infra	14.0	-
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	8.2	-
similar name	naming	6.8	-
appeared together (72h)	temporal	4	-

allegrolokalnie.oferta-lokalana694502304235.lol ↔ allegrolokalnie.ploferta23189192.rest 54 first reproduced 2026-08-25

allegrolokalnie.oferta-lokalana694502304235.lol allegrolokalnie.ploferta23189192.rest

Signal	Category	Contributed	IDF
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-
certs issued together	tls	3	-

allegro.ploferta3217832819.sbs ↔ allegrolokalnie.pl-dpd24.pl 54 first reproduced 2026-08-25

allegro.ploferta3217832819.sbs allegrolokalnie.pl-dpd24.pl

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-
registered together	registration	5	-
certs issued together	tls	3	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegrolokalnie.lokalna-ofeta92112.cfd ↔ allegrolokalnie.ploferta3217832819.sbs 51 first reproduced 2026-08-25

allegrolokalnie.lokalna-ofeta92112.cfd allegrolokalnie.ploferta3217832819.sbs

Signal	Category	Contributed	IDF
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar name	naming	9.0	-
similar name	naming	6.0	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

allegro.ploferta3217832819.sbs ↔ allegrolokalnie.ploferta23189192.rest 47 first reproduced 2026-08-25

allegro.ploferta3217832819.sbs allegrolokalnie.ploferta23189192.rest

Signal	Category	Contributed	IDF
same nameservers	infra	11.2	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
appeared together (24h)	temporal	6	-
registered together	registration	5	-
same registrar	registration	4	-

allegro.pi-ofeta089139.shop ↔ allegrolokalnie.oferta-lokalna8654968923445.shop 47 first reproduced 2026-08-24

allegro.pi-ofeta089139.shop allegrolokalnie.oferta-lokalna8654968923445.shop

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	14.7	-
same favicon	visual	10.3	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

allegro.ploferta23189192.rest ↔ allegrolokalnie.pl-dpd24.pl 46 first reproduced 2026-08-25

allegro.ploferta23189192.rest allegrolokalnie.pl-dpd24.pl

Signal	Category	Contributed	IDF	Notes
same screenshot	visual	12.8	×0.80
same favicon	visual	11.2	×0.80
same redirect target	infra	9.6	×0.80
similar text	content	6.0	-	screenshot_phash
appeared together (24h)	temporal	6	-

Discounted observations

similar colors

visual

0.0

screenshot_phash

Infrastructure footprint

IP addresses

188.114.97.3 2/10

172.67.150.105 1/10

172.67.136.179 1/10

172.67.199.141 1/10

172.67.211.111 1/10

ASNs

13335 10/10

Hosting orgs

Cloudflare, Inc. 10/10

Registrars

Global Domain Group LLC 7/10

nazwa.pl sp. z o.o. 1/10

TLS certs

WE1 10/10

Export JSON CSV TXT

corr-1.2.0 · built 2026-08-25 05:00 UTC - rebuilt daily

	1	2	3	4	5	6	7	8	9	10
1		100	66	47	36	55	55	54	25	25
2	100		66	62	51	70	70	69	40	25
3	66	66		86	39	58	58	46	25	25
4	47	62	86		74	54	54	42	60	45
5	36	51	39	74		54	54	42	60	45
6	55	70	58	54	54		73	61	40	25
7	55	70	58	54	54	73		61	54	25
8	54	69	46	42	42	61	61		40	28
9	25	40	25	60	60	40	54	40		47
10	25	25	25	45	45	25	25	28	47

	1	2	3	4	5	6	7	8	9	10
1		100	66	47	36	55	55	54	25	25
2	100		66	62	51	70	70	69	40	25
3	66	66		86	39	58	58	46	25	25
4	47	62	86		74	54	54	42	60	45
5	36	51	39	74		54	54	42	60	45
6	55	70	58	54	54		73	61	40	25
7	55	70	58	54	54	73		61	54	25
8	54	69	46	42	42	61	61		40	28
9	25	40	25	60	60	40	54	40		47
10	25	25	25	45	45	25	25	28	47

	1	2	3	4	5	6	7	8	9	10
1		100	66	47	36	55	55	54	25	25
2	100		66	62	51	70	70	69	40	25
3	66	66		86	39	58	58	46	25	25
4	47	62	86		74	54	54	42	60	45
5	36	51	39	74		54	54	42	60	45
6	55	70	58	54	54		73	61	40	25
7	55	70	58	54	54	73		61	54	25
8	54	69	46	42	42	61	61		40	28
9	25	40	25	60	60	40	54	40		47
10	25	25	25	45	45	25	25	28	47