Possible campaigns

Beta8 live campaigns grouping 30 domains (45 indicators) across 8 brands, rebuilt daily. Shared-infrastructure grouping of public detections, not an attribution claim.

Data built 2026-09-08 05:00 UTC · rebuilt daily

Recent Confidence Size
Show all campaigns
Screenshot of home-ledgrreliveapp.typedream.app
Ledger, TrezorNew
4e4f2ab7bba1
same nameservers · 9/9 members Aug 7, 2026 → Aug 29, 2026
58% suspected cluster
9 domains · 9 hosts · 9 active
Screenshot of 818144-kraken.com
KrakenNew
f1ac9df220cd
same IP · 3/3 members Sep 4, 2026
84% possible campaign
3 domains · 3 hosts · 3 active
Screenshot of build.comm-whatsapp.com
WhatsAppNew
a566bb7e172e
same IP · 3/3 members Sep 4, 2026 → Sep 7, 2026
74% possible campaign
3 domains · 18 hosts · 15 active
Screenshot of cn-spotify.cn
SpotifyNew
77c704d800ce
same IP · 3/3 members Sep 5, 2026
68% suspected cluster
3 domains · 3 hosts · 3 active
no screenshots available
RobloxNew
0c08ddef2f4e
same IP · 3/3 members
57% suspected cluster
3 domains · 3 hosts · 0 active

Same data as JSON: /api/v1/campaigns

Recently dissolved
coinbase 2026-09-08 whatsapp 2026-09-08 ingspain 2026-09-07 instagram 2026-09-06 microsoft 2026-09-06 instagram 2026-09-06 instagram 2026-09-06 whatsapp 2026-09-06 santander 2026-09-06 google 2026-09-06

A campaign dissolves when none of its indicators are in the active feed any more. Its key is derived from the exact member set, so only an essentially identical set of members revives the same identifier; a merged or split campaign instead continues under its successor's key.

Browse all archived campaigns →

Methodology & provenance
Generated
2026-09-08 05:00 UTC
Algorithm
corr-1.3.0
Input rows
858
Candidate pairs
37928
Edges written
840
Clusters written
9
Runtime
24.0s

Shared infrastructure excluded from clustering: 12 apex domains, 1 favicon hashes, 11 IPs, 3 nameserver sets, 77 TLS SAN entries.