Phishing kit · 4 sites

Because the same registrant kitops@proton.example 90%the same analytics / pixel ID UA-424242-1 90%the same TLS certificate aaaaaaaaaaaaaaaaaaaaaaaaaaa... 80%the same server 203.0.113.66 80%

Each of the 4 domains collects passwords or card details. 4 of 4 domains were registered within 7 day(s) (2026-10-04 → 2026-10-10): a batch, not a coincidence. 4/4 credential form.

• 4/4 credential form
• 1/4 external form action

How to stop it · the shortest way, first

The sites · 4

Who is with whom · 2 clusters

4 of the 4 sites are on one server. Sites that share exactly the same things are shown together, so a long list of links reads as one line.

Who against whom

How sure we are that two sites are one operation (the darker the cell, the surer). The number is shown from 75%, where two sites count as one operation.

Who shares what · every shared server, certificate, registrant and more

Same server (address) · 1

TLS certificates · 1

Analytics / pixel IDs · 1

Registrants · 1

Name servers · 2

Registrars · 1

Bought together · 1

Same page code · 1

Pages that look the same · 1

Favicons · 1

Toolkit · what the attacker uses

When the domains were registered · a ring = several bought within days of each other

Evidence per site · which site has which tie

Also in common, but weak · they never group sites

Confidence is the weakest tie that holds the group together. Every tie has a weight: how likely it is that two sites sharing it are one operation. A server on a CDN is no evidence; a registrar or a name server never ties two sites on its own. This report was generated from the evidence BrandWatch holds today; searching for more sites of this operation is a separate step the analyst starts.