Infrastructure c103
Daixin
9 addresses tied together by 8 correlations. Density 0.22, mean confidence 0.92 - one address links to all the others and they do not link to each other - usually the operator's own index or mirror list.
A line means the two addresses share one or more fingerprint values that almost nothing else in the corpus shares. Thicker is more confident; hover a line to see exactly which values, and how many other sites hold each one. Click a node to isolate its cluster.
A thick line is a high-confidence link: several rare values in common, or
one that essentially nobody else has. Confidence is
1 − ∏(1 − weight) over the shared signals, so corroboration
raises it and nothing single can push it past certainty.
A thin line is the floor: 0.60. Below that nothing is drawn at all. A single shared signal only counts when it comes from a signal type where most sites have a value of their own — which is why two hosts buying a certificate from the same CA is not a line, and seven pages emitting byte-identical headers is.
A bigger node has more corroborating signals of its own and more links into its cluster. Colour is the cluster, not the state; the state is on the node's card and in the table below.
What a cluster is not. It is a claim that these addresses share infrastructure, not that one person runs them. A shared reverse proxy build, a shared host and a shared operator all look the same from outside. The density and shape columns are the honest part. A clique is one deployment. A star is an operator publishing its own mirror list — strong evidence, poor shape, low density. A chain is a path, and its two ends are several inferences apart.
The signals
- Favicon (MurmurHash3)
- Byte-identical favicon. The same integer Shodan publishes as http.favicon.hash.
- Favicon (SHA-256)
- Byte-identical favicon, our own digest.
- Favicon (perceptual)
- Visually the same icon after a re-encode or a rescale, which breaks both byte hashes.
- TLS certificate
- The same leaf certificate. Proof of a shared host, until the certificate is renewed.
- TLS public key (SPKI)
- The same public key. Survives certificate rotation, so it outlives the certificate hash.
- TLS issuer
- Issued by the same CA or, for a self-signed onion, carrying the same issuer DN.
- TLS SAN entry
- Both certificates name the same host.
- TLS SAN list
- Identical set of subject alternative names.
- Header order
- The same response headers, in the same sequence, with the same capitalisation.
- Server banner
- Identical Server: header, version included.
- X-Powered-By
- Identical X-Powered-By banner.
- Generator
- Same <meta name="generator"> string.
- Cookie name
- The stack sets a cookie by the same name.
- CSP policy
- Byte-identical Content-Security-Policy, which is almost always hand-written per deployment.
- Onion version
- Same hidden-service protocol version.
- Error page
- The same body for a path that does not exist. Fingerprints the stack even when the front pages differ.
- DOM skeleton
- Same markup structure with all text and attribute values stripped. The mirror-on-a-new-address signal.
- Page content
- The same normalised page text.
- Page title
- Identical document title.
- Screenshot
- The rendered pages look the same.
- Bitcoin address
- The same BTC address is quoted on both.
- Monero address
- The same XMR address is quoted on both.
- Ethereum address
- The same ETH address is quoted on both.
- Litecoin address
- The same LTC address is quoted on both.
- Bitcoin Cash address
- The same BCH address is quoted on both.
- PGP fingerprint
- The same PGP key fingerprint is published on both.
- PGP key id
- The same PGP key id is published on both.
- The same contact address.
- Tox id
- The same Tox id.
- Session id
- The same Session id.
- Jabber/XMPP
- The same XMPP account.
- Telegram
- The same Telegram handle.
- Matrix
- The same Matrix id.
- Signal
- The same Signal contact.
- Onion reference
- They link to the same hidden service - or one of them links to the other.
| Cluster | Sites | Links | Density | Shape | Confidence | Linked by |
|---|---|---|---|---|---|---|
| Daixin c103 | 9 | 8 | 0.22 | star | 0.92 strong | Onion reference qlfnwdg2fyvmzmqkk33iwku32ynsbbk6hysorsvvadr4o7gfzs4t46yd... |
| Daixin Alive, |
7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion
|
8 links | ||||
| daixin Dead-Connection-Refused, |
qlfnwdg2fyvmzmqkk33iwku32ynsbbk6hysorsvvadr4o7gfzs4t46yd.onion
|
1 link | ||||
| DAIXIN Dead-Connection-Refused, |
232fwh5cea3ub6qguz3pynijxfzl2uj3c73nbrayipf3gq25vtq2r4qd.onion
|
1 link | ||||
| daixin Dead-Connection-Refused, |
pkx3r7xe42z7fgkjjbocf7okdh77bsvngwvp6arykksob7gleyswicyd.onion
|
1 link | ||||
| daixin Dead-Connection-Refused, |
kyk6lixosktvbtf3g6zte7kdzid2lwrprfod55mhwunafx6jzeoui7yd.onion
|
1 link | ||||
| daixin Dead-Connection-Refused, |
v66nzl27xxmrulq6c2plrzr7tryv2idflhclpoyxrrn3kfw5gkkpveid.onion
|
1 link | ||||
| daixin Dead-Connection-Refused, |
kolbh6putvp6aw3vpmsppor4kyzs7ctxfbp2donetycftz5jru73ytid.onion
|
1 link | ||||
| daixin Dead-Connection-Refused, |
r3h2balq6aa7plwe5p5bhxzwzxusrtldbfaamfseg33a5hk77bohzxyd.onion
|
1 link | ||||
| daixin Dead-Connection-Refused, |
htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onion
|
1 link | ||||
Every weight below is measured from this corpus, not configured. Resolution is the share of sites whose value in that signal is held by nobody else — above 0.5 the signal behaves like an identifier and may carry a link on its own, below it the signal is a classification and can only corroborate one. Best weight is the most informative value of that type currently in the data, where 1.0 would be unique.
| Signal | Sites | Distinct values | Resolution | Can stand alone | Best weight |
|---|---|---|---|---|---|
| Onion reference | 3,377 | 3,580 | 0.968 | identifier | 0.915 |
| Onion version | 3,279 | 2 | 0.000 | classification only | 0.704 |
| Header order | 428 | 250 | 0.500 | identifier | 0.886 |
| Server banner | 376 | 56 | 0.090 | classification only | 0.883 |
| Page title | 330 | 287 | 0.803 | identifier | 0.881 |
| Page content | 268 | 253 | 0.903 | identifier | 0.876 |
| Favicon (MurmurHash3) | 167 | 149 | 0.808 | identifier | 0.865 |
| Favicon (SHA-256) | 167 | 149 | 0.808 | identifier | 0.865 |
| Cookie name | 127 | 78 | 0.339 | classification only | 0.857 |
| TLS issuer | 86 | 21 | 0.105 | classification only | 0.844 |
| TLS SAN entry | 85 | 225 | 0.894 | identifier | 0.844 |
| TLS SAN list | 85 | 80 | 0.894 | identifier | 0.844 |
| X-Powered-By | 58 | 33 | 0.414 | classification only | 0.829 |
| 50 | 90 | 0.920 | identifier | 0.823 | |
| CSP policy | 44 | 43 | 0.955 | identifier | 0.817 |
| Generator | 16 | 14 | 0.813 | identifier | 0.604 |
| Screenshot | 9 | 3 | 0.000 | classification only | 0.685 |
| Favicon (perceptual) | 7 | 3 | 0.000 | classification only | 0.644 |
| Monero address | 4 | 4 | 1.000 | identifier | — |
| Tox id | 3 | 3 | 1.000 | identifier | — |
| PGP fingerprint | 3 | 4 | 1.000 | identifier | — |
| Telegram | 2 | 5 | 1.000 | identifier | — |
| Bitcoin address | 2 | 6 | 1.000 | identifier | — |
| Jabber/XMPP | 1 | 2 | 1.000 | identifier | — |
| PGP key id | 1 | 5 | 1.000 | identifier | — |