{"query": {"url": "https://amazon-secure-login.example.com/signin", "host": "amazon-secure-login.example.com", "normalized_host": "amazon-secure-login.example.com", "apex": "example.com"}, "known": {"in_active_feed": false, "previously_active": false, "in_new_registration_feed": false, "record": null}, "live_analysis": {"allowlisted": false, "brand_match": "amazon", "kw_score": 190, "impersonation": false, "url_signals": {"kw_score_norm": 1.0, "levenshtein_brand": 0.4, "idn_homograph": 0.0, "brand_in_subdomain": 1.0, "brand_in_apex_label": 0.0, "combosquat": 1.0, "tld_abuse": 0.1, "domain_length": 1.0, "subdomain_depth": 0.25, "hyphen_count": 0.5, "creds_in_url": 0.0, "nonstandard_port": 0.0, "char_entropy": 0.0, "clone_intent": 0.0, "paas_host": 0.0, "leet_brand": 0.0}, "path_signals": {"brand_off_host": 0.0, "suspicious_path": 1.0, "exec_page": 0.0}, "url_risk_score": 67, "url_risk": "high", "why": [{"signal": "kw_score_norm", "value": 1.0, "weight": 0.26, "points": 26.0, "kind": "weighted"}, {"signal": "brand_in_subdomain", "value": 1.0, "weight": 0.13, "points": 13.0, "kind": "weighted"}, {"signal": "suspicious_path", "value": 1.0, "weight": 0.0, "points": 12.0, "kind": "path_boost"}, {"signal": "levenshtein_brand", "value": 0.4, "weight": 0.16, "points": 6.4, "kind": "weighted"}, {"signal": "combosquat", "value": 1.0, "weight": 0.04, "points": 4.0, "kind": "weighted"}]}, "history": {"apex_prior_detections": 0, "apex_candidates_seen": 0, "apex_first_seen": null, "apex_last_seen": null, "brands_targeted": [], "scope": "apex"}, "action": {"queued_for_analysis": false, "reason": "reserved_domain"}, "external_feeds": {"openphish": false, "phishtank": false, "tweetfeed": false, "listed": false, "listed_scope": null, "note": null, "status": "ok", "feeds_ok": true}, "verdict": "likely_phishing", "verdict_confidence": "medium", "verdict_basis": ["the URL shape scores 67/100"], "probability": {"status": "ok", "p_malicious": 0.127, "percent": 13, "interval_80": [0.079, 0.198], "band": "unlikely", "relative_risk": 9.5, "coverage": "passive_url_only", "prior": 0.01342, "evidence": [{"class": "url_shape", "value": 67, "llr": 2.74, "direction": "toward_malicious"}, {"class": "external_feed", "value": "none", "llr": -0.39, "direction": "toward_benign"}, {"class": "trusted_zone", "value": "untrusted", "llr": 0.03, "direction": "neutral"}], "not_evaluated": [], "model_version": "2026-09-28.2", "note": "At this API's ~1.3% base rate of malicious hosts among queried URLs, this estimate is 9.5x the base rate. URL-only estimate; the page was not fetched. Brand-less phishing is invisible to URL-only analysis."}, "meta": {"analyzed_at": "2026-10-18T14:51:30.148959+00:00", "passive_only": true, "note": "Live signals are URL/domain-shape heuristics only; the target was NOT contacted. Known-record and history data come from the phishunt detection pipeline.", "docs": "https://phishunt.io/api/", "license": "CC0-1.0"}}