GA4
A single Google Analytics 4 property ID (G-NB117S8EJD) is deployed across 332 distinct scam domains, indicating centralized analytics tracking infrastructure shared by a coordinated fraud operation. This forensic signal reveals the attacker's use of a unified measurement account to monitor victim traffic and campaign performance across their entire scam portfolio.
Fingerprint
ga:G-NB117S8EJD- Detections
- 332
- Hash type
- Tracking ID
- Status
- Active
- Last scanned
- May 2026
442026-03
2802026-04
Detected domains
324247globtradesalliance.org
OnlineTrust 1Apr 26, 2026369tradex.com
OnlineTrust 1Apr 1, 2026access-gain.com
OnlineTrust 1Apr 26, 2026accumarket.org
OnlineTrust 1Apr 11, 2026accuratesmtfin.com
OnlineTrust 1Apr 14, 2026acetiqsinvests.ltd
OnlineTrust 1Apr 26, 2026advancedstocksonline.com
OnlineTrust 1Apr 11, 2026advanceoptionspro.com
OnlineTrust 1Apr 26, 2026advancetdpro.com
OnlineTrust 1Apr 26, 2026adventureprofit-remunaration.com
OnlineTrust 1Apr 26, 2026
Related signals
10GTM
Tracking: GTM #5
Nexus Syndicate
Active
- 332
- detections
UA
Tracking: UA #2
Nexus Syndicate
Active
- 332
- detections
GA4
Tracking: GA4 #9
Nexus Syndicate
Active
- 294
- detections
DOM
DOM #59
Nexus Syndicate
Active
- 34
- detections
FA
Favicon #12
Nexus Syndicate
Active
- 34
- detections
DOM
DOM #14
Nexus Syndicate
Active
- 32
- detections
DOM
DOM #116
Nexus Syndicate
Active
- 30
- detections
DOM
DOM #100
Nexus Syndicate
Active
- 29
- detections
DOM
DOM #36
Nexus Syndicate
Active
- 19
- detections
FA
Favicon #85
Nexus Syndicate
Active
- 12
- detections