Who is running these many domains.

An operator is a cluster of lookalikes tied together by infrastructure: a shared non-CDN IP (the host) or a shared SaaS-verification TXT token (the operator's tooling fingerprint). Each row shows the cluster size, which brands it targets, and a sample of domains. Click any chip to drill into a specific impostor.