Suspected cluster ac8520eb2371ACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Indicators
3Active
3Brands
1First seen
Aug 01, 2026Most recent detection
Aug 12, 2026 What these pages look like
Indicators
google1208.com
google1302.com Why this confidence
56%
suspected cluster
Link strength
30%
Evidence diversity
100%
Time compactness
88%
Strong-link share
0%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
similar name
aaaaaa9999
2/3
same screenshot
8a2da9aaaba9a9a9~8a2da9a9aba9a9a9 d=2
2/3
same nameservers
ns1.cdnetdns.net,ns2.cdnetdns.net
2/3
similar name
google1208~google1308 d=1
Brands targeted
Timeline (first seen)
Spread over 11 days
Aug 01
1
Aug 12
2
History
2026-08-24
created
first tracked with 3 indicators
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | · | 45 | |
| 2 | · | 45 | |
| 3 | 45 | 45 |
Each cell is the relationship score between two members, numbered as in the Indicators table above. Hover a cell for the domains and the signals behind it.
2 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Relationships
google1208.com ↔ google1308.com 45 first reproduced 2026-08-12
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 18.3 | - | |
| same nameservers | infra | 11.7 | - | |
| similar name | naming | 9.0 | - | |
| similar name | naming | 6.0 | - |
Discounted observations
| same ASN | infra | 0.0 | - | same_ip |
| same hosting org | infra | 0.0 | - | same_ip |
| similar colors | visual | 0.0 | - | no_corroborating_signal |
google1302.com ↔ google1308.com 45 first reproduced 2026-08-24
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 16.0 | - | |
| similar name | naming | 9.0 | - | |
| similar name | naming | 6.0 | - | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
Infrastructure footprint
Registrars
GoDaddy.com, LLC
3/3
TLS certs
Let's Encrypt
3/3