How Actor Attribution Works

How Actor Attribution Works

Actors are identified by correlating multiple independent OSINT markers.

1. Domain Infrastructure

Actors often use:

• Same NameServers
• Same hosting providers
• Same registration windows (e.g., 20 domains in 3 minutes)
• Same WHOIS patterns

2. Code Reuse

• JS files reused across domains
• Unique custom drainer code
• Hardcoded API endpoints
• Copy-pasted phishing templates

3. Behavioral Patterns

Actors targeting:

• The same brands
• The same regions
• The same crypto wallets

4. OSINT Correlation

• URLScan report patterns
• Repeated directories (/auth/, /verify/, /connect/)
• Matching phishing kits

5. Attribution Confidence

When 3+ independent markers match →
Actor cluster is confirmed.