Might it also be likely that they're using the same server IP for their different campaigns? Might be useful to perform a WHOIS lookup next time for further correlation. Also, keep an eye out for cryptocurrency deposits to potentially pinpoint a common digital wallet.