BU
A identical build hash detected across 78 scam domains indicates a cloned codebase or templated website framework shared by the same threat actor or operation. This forensic signal demonstrates coordinated infrastructure deployment where the same compiled application or website build was distributed across multiple domains to facilitate parallel phishing, investment fraud, or cryptocurrency scam campaigns.
Fingerprint
a87b0c57d3cd9d65- Detections
- 78
- Hash type
- Build artefact
- Status
- Active
- Last scanned
- May 2026
782026-03
Detected domains
78amolax.com
OnlineTrust 1Mar 21, 2026befonex.com
OnlineTrust 1Mar 21, 2026bigetex.org
OnlineTrust 1Mar 21, 2026bikitoken.com
OnlineTrust 6Mar 21, 2026binexes.com
OnlineTrust 1Mar 21, 2026bitcowox.com
OnlineTrust 2Mar 21, 2026bitnexo.us
OnlineTrust 1Mar 21, 2026blovas.com
OnlineTrust 1Mar 21, 2026bytradex.org
OnlineTrust 1Mar 21, 2026byzodex.com
OnlineTrust 2Mar 21, 2026
Related signals
8FA
Favicon #62
Nexus Syndicate
Active
- 88
- detections
DOM
DOM #66
Nexus Syndicate
Active
- 39
- detections
DOM
DOM #62
Nexus Syndicate
Active
- 16
- detections
DOM
DOM #28
Nexus Syndicate
Active
- 13
- detections
DOM
DOM #68
Nexus Syndicate
Active
- 12
- detections
DOM
DOM #65
Nexus Syndicate
Active
- 9
- detections
DOM
DOM #67
Nexus Syndicate
Active
- 8
- detections
DOM
DOM #57
Nexus Syndicate
Active
- 5
- detections