BU
A shared build hash across 16 domains indicates identical or near-identical website codebases, suggesting these sites were generated from the same template, framework, or automated deployment system. This forensic signal is consistent with a coordinated scam operation using cloned or mass-produced infrastructure to rapidly deploy multiple fraudulent domains.
Fingerprint
6209289b887f51dd- Detections
- 16
- Hash type
- Build artefact
- Status
- Active
- Last scanned
- May 2026
52026-03
112026-04
Detected domains
16alpha-play.cc
OnlineTrust 1Apr 13, 2026auros.cc
OnlineTrust 1Apr 1, 2026buagux.com
OnlineTrust 36Apr 1, 2026drakelion.com
OnlineTrust 1Mar 21, 2026drakelux.com
OnlineTrust 1Mar 21, 2026fowatu.com
OnlineTrust 1Apr 2, 2026kovadex.com
OnlineTrust 1Mar 20, 2026mrbet.win
OnlineTrust 1Apr 13, 2026ovoshark.com
OnlineTrust 1Mar 24, 2026playorbit.cc
OnlineTrust 1Apr 13, 2026
Related signals
10BU
Build #26
Nexus Syndicate
Active
- 118
- detections
FA
Favicon #42
Nexus Syndicate
Active
- 81
- detections
FA
Favicon #50
Nexus Syndicate
Active
- 55
- detections
DOM
DOM #47
Nexus Syndicate
Active
- 53
- detections
DOM
DOM #32
Nexus Syndicate
Active
- 40
- detections
FA
Favicon #41
Nexus Syndicate
Active
- 23
- detections
FA
Favicon #11
Nexus Syndicate
Active
- 17
- detections
CO
Content #14
Nexus Syndicate
Active
- 14
- detections
DOM
DOM #23
Nexus Syndicate
Active
- 9
- detections
DOM
DOM #63
Nexus Syndicate
Active
- 9
- detections