{"query": {"url": "https://amazon-secure-login.example.com/signin", "host": "amazon-secure-login.example.com", "normalized_host": "amazon-secure-login.example.com", "apex": "example.com"}, "known": {"in_active_feed": false, "previously_active": false, "in_new_registration_feed": false, "record": null}, "live_analysis": {"allowlisted": false, "brand_match": "amazon", "kw_score": 190, "impersonation": false, "url_signals": {"kw_score_norm": 1.0, "levenshtein_brand": 0.4, "idn_homograph": 0.0, "brand_in_subdomain": 1.0, "brand_in_apex_label": 0.0, "combosquat": 1.0, "tld_abuse": 0.1, "domain_length": 1.0, "subdomain_depth": 0.25, "hyphen_count": 0.5, "creds_in_url": 0.0, "nonstandard_port": 0.0, "char_entropy": 0.0, "clone_intent": 0.0, "paas_host": 0.0, "leet_brand": 0.0}, "path_signals": {"brand_off_host": 0.0, "suspicious_path": 1.0, "exec_page": 0.0}, "url_risk_score": 67, "url_risk": "high", "why": [{"signal": "kw_score_norm", "value": 1.0, "weight": 0.26, "points": 26.0, "kind": "weighted"}, {"signal": "brand_in_subdomain", "value": 1.0, "weight": 0.13, "points": 13.0, "kind": "weighted"}, {"signal": "suspicious_path", "value": 1.0, "weight": 0.0, "points": 12.0, "kind": "path_boost"}, {"signal": "levenshtein_brand", "value": 0.4, "weight": 0.16, "points": 6.4, "kind": "weighted"}, {"signal": "combosquat", "value": 1.0, "weight": 0.04, "points": 4.0, "kind": "weighted"}]}, "history": {"apex_prior_detections": 0, "apex_first_seen": null, "apex_last_seen": null, "brands_targeted": []}, "action": {"queued_for_analysis": false, "reason": "reserved_domain"}, "external_feeds": {"openphish": false, "phishtank": false, "tweetfeed": false, "listed": false, "listed_scope": null, "note": null, "status": "ok", "feeds_ok": true}, "verdict": "likely_phishing", "verdict_confidence": "medium", "verdict_basis": ["the URL shape scores 67/100"], "meta": {"analyzed_at": "2026-08-30T03:45:50.988763+00:00", "passive_only": true, "note": "Live signals are URL/domain-shape heuristics only; the target was NOT contacted. Known-record and history data come from the phishunt detection pipeline.", "docs": "https://phishunt.io/api/", "license": "CC0-1.0"}}