FA
The identical favicon hash appears across 81 distinct domains, indicating a shared visual branding asset that was copied wholesale across a coordinated network of scam sites. This forensic signal suggests either automated domain generation from a common template or manual cloning of a scam infrastructure by the same threat actor.
Fingerprint
c164e1ea36438d14- Detections
- 81
- Hash type
- Favicon hash
- Status
- Active
- Last scanned
- May 2026
102026-03
282026-04
432026-05
Detected domains
81alpha-play.cc
OnlineTrust 1Apr 13, 2026auros.cc
OnlineTrust 1Apr 1, 2026beastarcade.com
OnlineTrust 1Apr 19, 2026beastquests.com
OnlineTrust 1May 11, 2026beawex.com
OnlineTrust 12May 6, 2026bnbit.win
OnlineTrust 1May 11, 2026boacux.com
OnlineTrust 1May 11, 2026buagux.com
OnlineTrust 36Apr 1, 2026bugamb.at
OnlineTrust 1May 12, 2026casewin.to
OnlineTrust 1Mar 21, 2026
Associated networks
1Related signals
10BU
Build #26
Nexus Syndicate
Active
- 118
- detections
DOM
DOM #29
Nexus Syndicate
Active
- 115
- detections
FA
Favicon #50
Nexus Syndicate
Active
- 55
- detections
DOM
DOM #47
Nexus Syndicate
Active
- 53
- detections
DOM
DOM #32
Nexus Syndicate
Active
- 40
- detections
BU
Build #70
Nexus Syndicate
Active
- 36
- detections
BU
Build #66
Nexus Syndicate
Active
- 20
- detections
BU
Build #55
Nexus Syndicate
Active
- 16
- detections
BU
Build #60
Nexus Syndicate
Active
- 10
- detections
DOM
DOM #23
Nexus Syndicate
Active
- 9
- detections