Analysing again…leaving that link out and working out which sites are still connected
ALL CONFIRMED SITES · one map: are they connected, and by what?
✓
Analysis complete
· 1 site · 0 operations · 1 unattributed · 1 social page
Every site was mapped and investigated. The ties below use all of it.
1 confirmed site, and nothing strong ties any two of them together: no shared server, certificate, analytics ID or registrant.
0
confirmed sites
0
connected groups
0
sites in a group
0
no strong link
0
strong links
0
hints & common
The map
Big dot with a name = a site you confirmed (colour = severity) · small dot with a letter = something several sites have in common · line = “has that”, thicker = a stronger tie. Each operation sits in its own coloured area. Point at a dot to light up what it touches, click it for details. Scroll to zoom, drag the background to move the map, drag a dot to move it (double-click it to let go).
affiliate id · registrant · DNS token
server
TLS certificate · page code
analytics ID · where the data goes
redirect host
traffic campaign
dashed = a hint, not proof on its own
Which sites are connected · one card per operation (a group of sites that belong to one attacker)
No two confirmed sites share a server, certificate, analytics ID or registrant.
NO STRONG LINK TO THE OTHERS · 1
shopnova-id-check.com · Look-alike domains