One lookalike is a finding. Six that share infrastructure are a campaign, and that distinction changes the response — you report the set rather than the instance, and you gain the ability to predict the next one.
What links registrations
| Shared | Strength | Why |
|---|---|---|
| Nameservers | Strong | Especially a nameserver on a domain the attacker also registered. Few legitimate sets share an unusual pair. |
| Hosting IP | Moderate | Weakened by shared hosting and by CDNs, where thousands of unrelated sites share an address. |
| Registration timing | Moderate | Several lookalikes registered in one window is not coincidence. |
| Registrar | Weak alone | Useful as a corroborating factor, meaningless on its own. |
| TLS certificate | Strong | A single certificate covering several lookalike names is direct evidence of common control. |
| Site content | Strong | Identical clone artefacts — the same favicon hash, the same mistakes in the same places. |
The certificate that names the set
A certificate with multiple names in it is the cleanest link there is, and Certificate Transparency publishes every one of them.
bimi.certadns.com certadns.com www.certadns.com
Note what that shows even for a domain you control — bimi.certadns.com is a hostname that appears in no public page. Certificates disclose names, always, to everyone. That is the subject of a later module and it is also how you find an attacker’s whole set from one of its members.
What clustering buys
- A stronger report. Six linked domains is a pattern an abuse desk acts on; one is a ticket.
- Prediction. If they registered six variants, watch the rest of that generation class.
- Efficiency. One evidence package covers the set.
- A pivot. The infrastructure they reused is where the next campaign will appear.
Shared hosting is where clustering goes wrong
An IP address at a large provider may host tens of thousands of unrelated sites, so “shares an IP with a known-bad domain” is close to worthless on its own. Weight nameserver and certificate links heavily, and address links only when the address is not obviously shared.