This cluster centers on 4 connected domains identified through shared infrastructure and registration patterns. The domains include login.checkgo.org, files-editor.com, start.checkgo.org, checkgo.org.
This campaign was identified through automated analysis of threat intelligence feeds and entity relationship mapping.