Campaigns

80+ live tracked phishing and threat campaigns,
continuously updated. Follow the infrastructure
as it evolves, in the console or through the API.

Live tracked campaigns
Courier-theme smishing kit 1,204 domains ● live
Banking credential harvester 633 domains ● live
Crypto drainer network 287 domains ● live
Gov impersonation wave 148 domains ● live
Continuously updated 80+ campaigns tracked
Investigation-Ready

What's Inside Every Campaign

Each campaign is a living investigation object, curated and updated by Webamon as the actor's infrastructure changes. No stale IOC lists. You see what's live right now.

Full Domain Set

Every domain attributed to the campaign, from first observation onward, with new infrastructure added as it's discovered.

Liveness Status

Which domains are serving content right now versus parked, sinkholed, or taken down, so you can prioritise blocking what's active.

Infrastructure Detail

Hosting, certificates, technologies, and kit artifacts behind the campaign: the patterns that connect today's domains to tomorrow's.

Change History

How the campaign has evolved over time: growth waves, hosting moves, and takedown responses, all recorded as they happen.

Before They Have a Name

Emerging Clusters

Most intel tells you about campaigns after they've done damage. Webamon surfaces new infrastructure clusters automatically: groups of related domains, certificates, and kit fingerprints forming into something coordinated, before they're promoted to full tracked campaigns.

You see attacks forming, not just confirmed. When a cluster matures into a campaign, the full history comes with it.

Automatic Clustering

Related infrastructure is grouped by shared fingerprints across scans, certificates, and feeds. No manual pivoting required.

Cluster to Campaign

Analysts review and promote clusters into named, tracked campaigns, so every campaign starts with its full pre-history already mapped.

Console and Code

Work in the Console, or Pull It All by API

Browse and pivot through campaigns in the console, or pull every campaign programmatically: domains, liveness, and infrastructure, straight into your SIEM, blocklists, and tooling.

Campaigns Console

Explore every tracked campaign interactively: filter domains by liveness, pivot into scans and screenshots, and follow infrastructure changes as they land.

Available from the Researcher plan

Campaigns API

# List tracked campaigns
GET /campaigns

# Pull a campaign's domains + liveness
GET /campaigns/{id}/domains

Available from the Research Lab plan up

Track the campaigns targeting you

80+ live tracked campaigns, updated continuously
Console access from Researcher, full API from Research Lab
From first cluster to final takedown