Infrastructure c580
ailock
34 addresses tied together by 33 correlations. Density 0.06, mean confidence 0.92 - one address links to all the others and they do not link to each other - usually the operator's own index or mirror list.
A line means the two addresses share one or more fingerprint values that almost nothing else in the corpus shares. Thicker is more confident; hover a line to see exactly which values, and how many other sites hold each one. Click a node to isolate its cluster.
A thick line is a high-confidence link: several rare values in common, or
one that essentially nobody else has. Confidence is
1 − ∏(1 − weight) over the shared signals, so corroboration
raises it and nothing single can push it past certainty.
A thin line is the floor: 0.60. Below that nothing is drawn at all. A single shared signal only counts when it comes from a signal type where most sites have a value of their own — which is why two hosts buying a certificate from the same CA is not a line, and seven pages emitting byte-identical headers is.
A bigger node has more corroborating signals of its own and more links into its cluster. Colour is the cluster, not the state; the state is on the node's card and in the table below.
What a cluster is not. It is a claim that these addresses share infrastructure, not that one person runs them. A shared reverse proxy build, a shared host and a shared operator all look the same from outside. The density and shape columns are the honest part. A clique is one deployment. A star is an operator publishing its own mirror list — strong evidence, poor shape, low density. A chain is a path, and its two ends are several inferences apart.
The signals
- Favicon (MurmurHash3)
- Byte-identical favicon. The same integer Shodan publishes as http.favicon.hash.
- Favicon (SHA-256)
- Byte-identical favicon, our own digest.
- Favicon (perceptual)
- Visually the same icon after a re-encode or a rescale, which breaks both byte hashes.
- TLS certificate
- The same leaf certificate. Proof of a shared host, until the certificate is renewed.
- TLS public key (SPKI)
- The same public key. Survives certificate rotation, so it outlives the certificate hash.
- TLS issuer
- Issued by the same CA or, for a self-signed onion, carrying the same issuer DN.
- TLS SAN entry
- Both certificates name the same host.
- TLS SAN list
- Identical set of subject alternative names.
- Header order
- The same response headers, in the same sequence, with the same capitalisation.
- Server banner
- Identical Server: header, version included.
- X-Powered-By
- Identical X-Powered-By banner.
- Generator
- Same <meta name="generator"> string.
- Cookie name
- The stack sets a cookie by the same name.
- CSP policy
- Byte-identical Content-Security-Policy, which is almost always hand-written per deployment.
- Onion version
- Same hidden-service protocol version.
- Error page
- The same body for a path that does not exist. Fingerprints the stack even when the front pages differ.
- DOM skeleton
- Same markup structure with all text and attribute values stripped. The mirror-on-a-new-address signal.
- Page content
- The same normalised page text.
- Page title
- Identical document title.
- Screenshot
- The rendered pages look the same.
- Bitcoin address
- The same BTC address is quoted on both.
- Monero address
- The same XMR address is quoted on both.
- Ethereum address
- The same ETH address is quoted on both.
- Litecoin address
- The same LTC address is quoted on both.
- Bitcoin Cash address
- The same BCH address is quoted on both.
- PGP fingerprint
- The same PGP key fingerprint is published on both.
- PGP key id
- The same PGP key id is published on both.
- The same contact address.
- Tox id
- The same Tox id.
- Session id
- The same Session id.
- Jabber/XMPP
- The same XMPP account.
- Telegram
- The same Telegram handle.
- Matrix
- The same Matrix id.
- Signal
- The same Signal contact.
- Onion reference
- They link to the same hidden service - or one of them links to the other.
| Cluster | Sites | Links | Density | Shape | Confidence | Linked by |
|---|---|---|---|---|---|---|
| ailock c580 | 34 | 33 | 0.06 | star | 0.92 strong | Onion reference toczr6bmtfbgardwgcgbeqntumkxi3y2tsfbcstybf6xknd6cm6e32ad... |
| ailock Alive, |
dhnsppqjaaa22lsqxl2tfhji4ca43743kubltnodvsft3hkvai77p6ad.onion
|
33 links | ||||
| abyss-data Alive, |
tycacxbqdhohowofueufbnekscyomymoxbr4wlim5cqpfv72z6popcid.onion
|
1 link | ||||
| abyss-data Alive, |
gzpjpapbvqcom6yrjnijfyzspfb7oyqt5xni4uxapwfsddw4n4v5wqyd.onion
|
1 link | ||||
| abyss-data Alive, |
toczr6bmtfbgardwgcgbeqntumkxi3y2tsfbcstybf6xknd6cm6e32ad.onion
|
1 link | ||||
| abyss-data Alive, |
euujzkwziy777bg4oyiks2x3s5cxlydao6jhpilzdjmjohja3s4v7jid.onion
|
1 link | ||||
| abyss-data Alive, |
s5v5hvtk3oyxg3m6afgxeuwlasqku3adeosv7kwwjfvhf22vqiwotrqd.onion
|
1 link | ||||
| abyss-data Alive, |
ah73jnvhuoznb4n3srbtspsgrdyyde2xszywcjryjroz4wixhwmdrjad.onion
|
1 link | ||||
| abyss-data Alive, |
yehbrr7tnzrcpcq2fglrf73ug2jqhgngxnyv3clyhrswdwmg45p7fyad.onion
|
1 link | ||||
| abyss-data Alive, |
l7f3ny5yedcm7zhgxzy34mihk6jvgwg7m6qj3cqw4nvky7xv5wttegyd.onion
|
1 link | ||||
| abyss-data Alive, |
7lpodmzejui2scqfojx3voadc7fgrt2igww6ipjtnztfg6hprnmel5yd.onion
|
1 link | ||||
| abyss-data Alive, |
ub63kcmphxbm3m64wwhuznbxfap4hlgqtauhnf4rvz23cdnrqr4towid.onion
|
1 link | ||||
| abyss-data Alive, |
jdr3i5np2nyfaa3jut2wnbymrb7dceunpi63no4gvcvr7wrwbqff2wid.onion
|
1 link | ||||
| abyss-data Alive, |
46vfmzfh3uxc3ojn6z267jmiytfhxzq4x7vvnqtycu5wa6hh3jl2hjyd.onion
|
1 link | ||||
| ailock Alive, |
eddo6w66t6t4kribwjbxvtehtsny4g6j2a5gj6pzivivcu5nywhegtqd.onion
|
1 link | ||||
| ailock Alive, |
qvqoau7353xe7wm3z6fzxn33q63ck7cys56wsbx25c22fnxyu4fzhnyd.onion
|
1 link | ||||
| ailock Alive, |
44ga7x7kicz2bbxaohdfw5iw6j7dgg4kyctwtf4kh6gsxifbah4jv4ad.onion
|
1 link | ||||
| ailock Alive, |
igf7rlhjtvitxh72suhb55hqic67pvphbqikkrqqilzj3drhirglziyd.onion
|
1 link | ||||
| ailock Alive, |
woed7o3il2jrxzczupntvhutc2ogs5otn6ekgoya6qo33qcuhomkhwad.onion
|
1 link | ||||
| ailock Alive, |
dwwnfgp43qjp5cy7n3ab6g5ubdxk4jkma37oykt6loeet7cyadtty5qd.onion
|
1 link | ||||
| ailock Alive, |
qcncet2rpvs3t5lnvuzzth3vbro46snkylgyqx3igdnb5bv324nzojqd.onion
|
1 link | ||||
| ailock Alive, |
27kmvzlfn3dpb6s4zq3qknqpcbrk5qzhwmg5awhjmu3m2okgpd4pgrid.onion
|
1 link | ||||
| ailock Alive, |
fgx4uh7pzf4xr7k56opyfsy7qmg64xisiv5scgcadaddur7qiv6t3yyd.onion
|
1 link | ||||
| ailock Alive, |
tsz2oqrfnyik3vtcx5rzubfuam3n5kapvkkagqr7yzxdxvdhehjxghqd.onion
|
1 link | ||||
| ailock Alive, |
q37z64a4j7455p6zcdxfpqrrgctmd46vaz2uejsqgxbmrcjbd4w3fqid.onion
|
1 link | ||||
| ailock Alive, |
epnsv5xaxnrks5yliq5wlthbmdlidkjddon3rx5llftx4ueiwfzdx6ad.onion
|
1 link | ||||
| ailock Alive, |
to3odzfolkvhkj3jf5oo3qq5hvdycy5n5n6bi564yrxdgavnwv5znjqd.onion
|
1 link | ||||
| ailock Alive, |
ccpgp25zc37xccprbjr46iurz5c5awhqxltm6xn7nef7dxpsyegwncid.onion
|
1 link | ||||
| ailock Alive, |
pptiuraybrwacfl5v2qmzknenqxwt5eojtbh5cxxejaq3oo4bidkv7id.onion
|
1 link | ||||
| ailock Alive, |
x7ghos27bltjtfombanecwgynfk4jw53ewkhzfnb5f27qmuquxwzhyad.onion
|
1 link | ||||
| ailock Alive, |
ejqsesb5cgero35i7ujerpuslbokhuwl3dqgsrg44bzamamccf7fw3ad.onion
|
1 link | ||||
| ailock Alive, |
tgyvw6pui3apxlezhiht5ubcmbm6fzn5klh2fi6qcqbvqhhfkyhnejad.onion
|
1 link | ||||
| ailock Alive, |
b26gczu5dbhaovnkp5c3ef3vdphqxj64z4nwzvfdabplbptgp56gsdyd.onion
|
1 link | ||||
| ailock Alive, |
mbqmgrf2kvabejqmoh4kl5tw5fko5pphzmmlbxhgjp5ar5ret7qpobad.onion
|
1 link | ||||
| ailock Alive, |
wqse4qzvrtbg5o3evt2eexovcilxpvlsopwvpu7toimx64njqekzuqid.onion
|
1 link | ||||
Every weight below is measured from this corpus, not configured. Resolution is the share of sites whose value in that signal is held by nobody else — above 0.5 the signal behaves like an identifier and may carry a link on its own, below it the signal is a classification and can only corroborate one. Best weight is the most informative value of that type currently in the data, where 1.0 would be unique.
| Signal | Sites | Distinct values | Resolution | Can stand alone | Best weight |
|---|---|---|---|---|---|
| Onion reference | 3,377 | 3,580 | 0.968 | identifier | 0.915 |
| Onion version | 3,279 | 2 | 0.000 | classification only | 0.704 |
| Header order | 428 | 250 | 0.500 | identifier | 0.886 |
| Server banner | 376 | 56 | 0.090 | classification only | 0.883 |
| Page title | 330 | 287 | 0.803 | identifier | 0.881 |
| Page content | 268 | 253 | 0.903 | identifier | 0.876 |
| Favicon (MurmurHash3) | 167 | 149 | 0.808 | identifier | 0.865 |
| Favicon (SHA-256) | 167 | 149 | 0.808 | identifier | 0.865 |
| Cookie name | 127 | 78 | 0.339 | classification only | 0.857 |
| TLS issuer | 86 | 21 | 0.105 | classification only | 0.844 |
| TLS SAN entry | 85 | 225 | 0.894 | identifier | 0.844 |
| TLS SAN list | 85 | 80 | 0.894 | identifier | 0.844 |
| X-Powered-By | 58 | 33 | 0.414 | classification only | 0.829 |
| 50 | 90 | 0.920 | identifier | 0.823 | |
| CSP policy | 44 | 43 | 0.955 | identifier | 0.817 |
| Generator | 16 | 14 | 0.813 | identifier | 0.604 |
| Screenshot | 9 | 3 | 0.000 | classification only | 0.685 |
| Favicon (perceptual) | 7 | 3 | 0.000 | classification only | 0.644 |
| Monero address | 4 | 4 | 1.000 | identifier | — |
| Tox id | 3 | 3 | 1.000 | identifier | — |
| PGP fingerprint | 3 | 4 | 1.000 | identifier | — |
| Telegram | 2 | 5 | 1.000 | identifier | — |
| Bitcoin address | 2 | 6 | 1.000 | identifier | — |
| Jabber/XMPP | 1 | 2 | 1.000 | identifier | — |
| PGP key id | 1 | 5 | 1.000 | identifier | — |