Operator clusters
Groups of apps that share an operator — same signing key, same publisher, same registered address, shared bootstrap infrastructure, or identical bundled-SDK fingerprint. Same-signing-cert is the strongest signal (same private key signed both).
Clustering signals (high → low confidence)
- Same signing-cert SHA-256
- Definitive — the same private key signed both apps. Captures the operator regardless of publisher name.
- Same Play developer (normalised)
- Same legal entity, possibly multiple brands.
- Same registered address
- Co-located publishers, often sister companies.
- Same Firebase project ID
- Same backend tenant.
- Shared bootstrap hostnames
- Apps reach the same control-plane hosts. Generic infrastructure hosts (Google, Cloudflare, ipinfo.io) are filtered out.
- SDK-set Jaccard ≥ 0.85
- Same compiled-SDK fingerprint with ≥ 4 SDKs in common — strong sign of shared codebase.