Amusing Numerology: Analysis of the Numbers in Domain Names

This report examines 6,958 .com domains registered in November–December 2024 and demonstrates that three independently detected infrastructure clusters are actually a single campaign: the decisive indicator is an eight-digit numeric suffix that uses only digits 0–4 (a base-5 encoding) with a uniform distribution and consistent fixed-width formatting, combined with shared vocabulary and overlapping registration timing, which together identify a unique generator fingerprint used to provision the domains.