Snell13 analysis layers
All campaigns

Same kit

Confirmed

5 entities · first seen 3h ago · last 2h ago

At least one member was judged dangerous by its own analysis. The group carries that status, which does not condemn every one of its members.

Why these entities hold together

The pages serve the same favicon, the same document structure or the same certificate — byte for byte. This is the strongest pivot: an attacker renews domain names every day, but does not rewrite the tool.

  • Structure de page identique : même gabarit, donc même kit.
  • Certificat TLS partagé.
Cohesion40%

Share of member pairs actually linked. At 100% every member is linked to every other — a block. A low value describes a chain: the ends may have no direct relation.

Where this group comes from

Grouped by

Grouping is computed here, on our own database. No external source hands over a ready-made campaign.

  • Moteur de corrélationin-house13 edges

Members seen by

How these items entered the database: a public list, an analysis run here, the sandbox, a user report. An entry point, not authorship.

  • OpenPhishreports threats2/5
  • RDAPproduces facts, does not judge2/5
  • Bac à sableproduces facts, does not judge2/5

Group composition

url2dom_hash2cert_sha2561

What links the members

Edges per pivot family. One pair of members can be linked several times: these shares count evidence, not entities.

Same kit4

Registrars

Where the names were registered. The same outfit recurring is a sign of bulk purchase.

  • Tucows Domains Inc3

Most recent days

Observations per day, most recent first.

  • 16 Aug 20263

Members · 5

Each member keeps its own verdict: belonging to the group makes it worth examining, not guilty. The joining reason is shown only when it differs from the patterns above.