Suspected cluster df3aee70a9d3ACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Indicators
3Active
3Brands
2First seen
May 12Last activity
May 15 What these pages look like
Why this confidence
65%
suspected cluster
Link strength
36%
Evidence diversity
100%
Time compactness
93%
Strong-link share
50%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same TLS cert
897eb86112360ee4445589437fd72b5f635fbcb414d0edab26a155544271df47
2/3
same apex
authorised-support.com
2/3
same nameservers
ns-1082.awsdns-07.org,ns-1801.awsdns-33.co.uk,ns-327.awsdns-40.com,ns-945.awsdns-54.net
2/3
same screenshot
956a6b85d8858e3e~946a6a95d8859e3e d=4
Brands targeted
Timeline (first seen)
Spread over 3 days
May 12
1
May 14
1
May 15
1
History
2026-08-02
created
first tracked with 3 indicators
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
How the members connect
| 1 | 2 | 3 | |
|---|---|---|---|
| 1 | 60 | 34 | |
| 2 | 60 | 48 | |
| 3 | 34 | 48 |
Each cell is the relationship score between two members, numbered as in the Indicators table below. Hover a cell for the domains and the signals behind it.
3 of 3 possible pairs are directly linked. A blank cell only means those two are not linked directly, they can still belong to the cluster through a third member.
Infrastructure footprint
Indicators
microsoft.authorised-support.com