FA
A single favicon file (identified by hash 985506f18ba4d9a1) is deployed identically across 23 different domains, indicating a shared codebase or website template used for mass scam deployment. This forensic signal demonstrates infrastructure reuse common to phishing or fraudulent trading platforms operated as part of a coordinated campaign.
Fingerprint
985506f18ba4d9a1- Detections
- 23
- Hash type
- Favicon hash
- Status
- Active
- Last scanned
- May 2026
182026-03
52026-05
Detected domains
23boferex.com
OnlineTrust 1May 1, 2026darodex.com
OnlineTrust 1Mar 20, 2026doterex.com
OnlineTrust 2May 1, 2026galowex.com
OnlineTrust 1Mar 23, 2026garopex.com
OnlineTrust 1Mar 20, 2026gomerex.com
OnlineTrust 2May 1, 2026kovadex.com
OnlineTrust 1Mar 20, 2026kurepex.com
OnlineTrust 1Mar 23, 2026lomedex.com
OnlineTrust 1Mar 23, 2026meovex.com
OnlineTrust 1Mar 23, 2026
Related signals
9BU
Build #26
Nexus Syndicate
Active
- 118
- detections
DOM
DOM #29
Nexus Syndicate
Active
- 115
- detections
BU
Build #18
Nexus Syndicate
Active
- 73
- detections
BU
Build #7
Nexus Syndicate
Active
- 72
- detections
DOM
DOM #47
Nexus Syndicate
Active
- 53
- detections
DOM
DOM #32
Nexus Syndicate
Active
- 40
- detections
FA
Favicon #11
Nexus Syndicate
Active
- 17
- detections
BU
Build #55
Nexus Syndicate
Active
- 16
- detections
CO
Content #14
Nexus Syndicate
Active
- 14
- detections