Suspected cluster d6587d0fe22fACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
321 hostsActive
21Brands
1First seen
Sep 04, 2026Most recent detection
Sep 06, 2026 What these pages look like
Domains
| Domain | Hosts | Active |
|---|---|---|
| comm-whatsapp.com | 8 | 8 |
| scan-whatsapp.com | 3 | 3 |
| static-whatsapp.com | 10 | 10 |
Indicators
build.comm-whatsapp.com
Why this confidence
66%
suspected cluster
Link strength
37%
Evidence diversity
100%
Time compactness
98%
Strong-link share
50%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same nameservers
ns1.kenpains.com,ns2.kenpains.com
2/3
similar name
patch
2/3
similar name
private
Brands targeted
Timeline (first seen)
Spread over 2 days
Sep 04
11
Sep 06
10
History
2026-09-07
created
first tracked with 3 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
Strongest links
65
build.comm-whatsapp.com ↔ calendar.scan-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
65
build.comm-whatsapp.com ↔ docs.scan-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
65
calendar.scan-whatsapp.com ↔ patch.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
65
calendar.scan-whatsapp.com ↔ private.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
65
docs.scan-whatsapp.com ↔ patch.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
65
docs.scan-whatsapp.com ↔ private.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
59
desktop.scan-whatsapp.com ↔ local.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
59
desktop.scan-whatsapp.com ↔ photo.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
59
desktop.scan-whatsapp.com ↔ premium.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
59
desktop.scan-whatsapp.com ↔ sandbox.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
Supplemental links
Linked below the clustering threshold or by same-kit similarity - did not form this cluster.
92
calendar.scan-whatsapp.com ↔ docs.scan-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
87
build.comm-whatsapp.com ↔ patch.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
87
build.comm-whatsapp.com ↔ private.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
87
patch.comm-whatsapp.com ↔ private.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
81
local.comm-whatsapp.com ↔ photo.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
81
local.comm-whatsapp.com ↔ premium.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
81
local.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
81
photo.comm-whatsapp.com ↔ premium.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
81
photo.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
81
premium.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
Relationships
build.comm-whatsapp.com ↔ calendar.scan-whatsapp.com 65 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.3 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| same nameservers | infra | 6.9 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| appeared together (24h) | temporal | 6 | - | |
| same redirect target | infra | 5.8 | ×0.50 | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
build.comm-whatsapp.com ↔ docs.scan-whatsapp.com 65 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.3 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| same nameservers | infra | 6.9 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| appeared together (24h) | temporal | 6 | - | |
| same redirect target | infra | 5.8 | ×0.50 | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ patch.comm-whatsapp.com 65 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.3 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| same nameservers | infra | 6.9 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| appeared together (24h) | temporal | 6 | - | |
| same redirect target | infra | 5.8 | ×0.50 | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ private.comm-whatsapp.com 65 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.3 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| same nameservers | infra | 6.9 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| appeared together (24h) | temporal | 6 | - | |
| same redirect target | infra | 5.8 | ×0.50 | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ patch.comm-whatsapp.com 65 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.3 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| same nameservers | infra | 6.9 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| appeared together (24h) | temporal | 6 | - | |
| same redirect target | infra | 5.8 | ×0.50 | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ private.comm-whatsapp.com 65 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.3 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| same nameservers | infra | 6.9 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| appeared together (24h) | temporal | 6 | - | |
| same redirect target | infra | 5.8 | ×0.50 | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ local.comm-whatsapp.com 59 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ photo.comm-whatsapp.com 59 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ premium.comm-whatsapp.com 59 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ sandbox.comm-whatsapp.com 59 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ works.comm-whatsapp.com 52 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
build.comm-whatsapp.com ↔ desktop.scan-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ local.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ photo.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ premium.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ sandbox.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ patch.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ private.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ local.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ photo.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ premium.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ sandbox.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same screenshot | visual | 8.0 | ×0.50 | |
| same nameservers | infra | 7.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
patch.comm-whatsapp.com ↔ patch.static-whatsapp.com 47 first reproduced 2026-09-06
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.6 | ×0.80 | |
| similar name | naming | 10.0 | - | |
| same nameservers | infra | 7.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
private.comm-whatsapp.com ↔ private.static-whatsapp.com 47 first reproduced 2026-09-06
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 17.6 | ×0.80 | |
| similar name | naming | 10.0 | - | |
| same nameservers | infra | 7.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| certs issued together | tls | 3 | - |
Infrastructure footprint