{
  "id": 484,
  "key": "35cdcfba834a",
  "size": 3,
  "active_count": 3,
  "brands": [
    "bankinter",
    "citrix",
    "microsoft"
  ],
  "confidence": "suspected cluster",
  "confidence_score": 0.638,
  "confidence_metrics": {
    "B": 0.5,
    "D": 0.38,
    "S": 1.0,
    "T": 0.833,
    "V": 1.0
  },
  "first_seen": "2026-08-09 05:25:57.387686+00:00",
  "last_activity": "2026-08-24 05:25:26.423194+00:00",
  "top_evidence": {
    "type": "favicon_phash_exact",
    "coverage": "3/3 members"
  },
  "url": "https://phishunt.io/campaigns/35cdcfba834a/",
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-08-25T05:00:30.023518+00:00",
  "evidence_summary": [
    {
      "type": "favicon_phash_exact",
      "value": "ec94b14bceb49916",
      "members_matching": 3
    },
    {
      "type": "shared_final_host",
      "value": "www.google.com",
      "members_matching": 3
    },
    {
      "type": "screenshot_phash_full",
      "value": "8bdd66cc62cc668c~8bdd66cc62cc668c d=0",
      "members_matching": 3
    },
    {
      "type": "ocr_similarity_full",
      "value": "jaccard=1.00",
      "members_matching": 3
    },
    {
      "type": "same_ip",
      "value": "159.246.29.210",
      "members_matching": 2
    },
    {
      "type": "temporal_24h",
      "value": "12.0h",
      "members_matching": 2
    },
    {
      "type": "same_registrar",
      "value": "Tucows Domains Inc.",
      "members_matching": 2
    }
  ],
  "first_tracked": "2026-08-25T05:00:30.023518+00:00",
  "history": [
    {
      "at": "2026-08-25T05:00:30.023518+00:00",
      "event": "created",
      "size": 3,
      "joined": [
        "authentication.citrix-sharing.com",
        "bankinteronline.com",
        "microsoft.vpn-update.org"
      ],
      "left": []
    }
  ],
  "members": [
    {
      "uuid": "03db0f18-004b-481c-bd30-496fe517a54d",
      "domain": "authentication.citrix-sharing.com",
      "url": "https://authentication.citrix-sharing.com",
      "company": "citrix",
      "status": "active",
      "first_seen": "2026-08-23 17:24:00.168715+00:00",
      "relationship_score": 65,
      "relationship_tier": "high",
      "detail_url": "https://phishunt.io/suspicious/citrix/03db0f18-004b-481c-bd30-496fe517a54d/",
      "image": "screenshots/citrix/03db0f18-004b-481c-bd30-496fe517a54d.png",
      "phishunt_score": 23,
      "ip": "159.246.29.210",
      "asn": "30491",
      "org": "Crowe LLP",
      "country": "United States",
      "registrar": "Tucows Domains Inc.",
      "cert": "YE1",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": ""
    },
    {
      "uuid": "e11b1437-2975-4e1f-b204-5f066b1c849e",
      "domain": "bankinteronline.com",
      "url": "https://bankinteronline.com",
      "company": "bankinter",
      "status": "active",
      "first_seen": "2026-08-24 05:25:26.423194+00:00",
      "relationship_score": 49,
      "relationship_tier": "medium",
      "detail_url": "https://phishunt.io/suspicious/bankinter/e11b1437-2975-4e1f-b204-5f066b1c849e/",
      "image": "screenshots/bankinter/e11b1437-2975-4e1f-b204-5f066b1c849e.png",
      "phishunt_score": 38,
      "ip": "188.114.97.3",
      "asn": "13335",
      "org": "Cloudflare, Inc.",
      "country": "United States",
      "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
      "cert": "WE1",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": ""
    },
    {
      "uuid": "b502902a-e5e4-4cbf-b958-ca816cb59d87",
      "domain": "microsoft.vpn-update.org",
      "url": "https://microsoft.vpn-update.org",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-08-09 05:25:57.387686+00:00",
      "relationship_score": 65,
      "relationship_tier": "high",
      "detail_url": "https://phishunt.io/suspicious/microsoft/b502902a-e5e4-4cbf-b958-ca816cb59d87/",
      "image": "screenshots/microsoft/b502902a-e5e4-4cbf-b958-ca816cb59d87.png",
      "phishunt_score": 21,
      "ip": "159.246.29.210",
      "asn": "30491",
      "org": "Crowe LLP",
      "country": "United States",
      "registrar": "Tucows Domains Inc.",
      "cert": "-",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": ""
    }
  ],
  "relationships": [
    {
      "domain_a": "authentication.citrix-sharing.com",
      "domain_b": "microsoft.vpn-update.org",
      "detail_url_a": "https://phishunt.io/suspicious/citrix/03db0f18-004b-481c-bd30-496fe517a54d/",
      "detail_url_b": "https://phishunt.io/suspicious/microsoft/b502902a-e5e4-4cbf-b958-ca816cb59d87/",
      "score": 65,
      "tier": "high",
      "demotion_reason": null,
      "first_reproduced": "2026-08-24",
      "evidence": [
        {
          "label": "same IP",
          "signal": "same_ip",
          "category": "infra",
          "contributed": 19.4,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same favicon",
          "signal": "favicon_phash_exact",
          "category": "visual",
          "contributed": 13.1,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same screenshot",
          "signal": "screenshot_phash_full",
          "category": "visual",
          "contributed": 11.9,
          "idf_factor": 0.8,
          "dampened_by": null
        },
        {
          "label": "same redirect target",
          "signal": "shared_final_host",
          "category": "infra",
          "contributed": 10.6,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "similar text",
          "signal": "ocr_similarity_full",
          "category": "content",
          "contributed": 6.0,
          "idf_factor": null,
          "dampened_by": "screenshot_phash"
        },
        {
          "label": "same registrar",
          "signal": "same_registrar",
          "category": "registration",
          "contributed": 4,
          "idf_factor": null,
          "dampened_by": null
        }
      ],
      "discounted": [
        {
          "label": "same ASN",
          "signal": "same_asn",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "same hosting org",
          "signal": "same_org",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "similar colors",
          "signal": "dominant_colors_match",
          "category": "visual",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "screenshot_phash"
        }
      ]
    },
    {
      "domain_a": "authentication.citrix-sharing.com",
      "domain_b": "bankinteronline.com",
      "detail_url_a": "https://phishunt.io/suspicious/citrix/03db0f18-004b-481c-bd30-496fe517a54d/",
      "detail_url_b": "https://phishunt.io/suspicious/bankinter/e11b1437-2975-4e1f-b204-5f066b1c849e/",
      "score": 49,
      "tier": "medium",
      "demotion_reason": null,
      "first_reproduced": "2026-08-25",
      "evidence": [
        {
          "label": "same favicon",
          "signal": "favicon_phash_exact",
          "category": "visual",
          "contributed": 13.1,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same redirect target",
          "signal": "shared_final_host",
          "category": "infra",
          "contributed": 12.0,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same screenshot",
          "signal": "screenshot_phash_full",
          "category": "visual",
          "contributed": 11.9,
          "idf_factor": 0.8,
          "dampened_by": null
        },
        {
          "label": "similar text",
          "signal": "ocr_similarity_full",
          "category": "content",
          "contributed": 6.0,
          "idf_factor": null,
          "dampened_by": "screenshot_phash"
        },
        {
          "label": "appeared together (24h)",
          "signal": "temporal_24h",
          "category": "temporal",
          "contributed": 6,
          "idf_factor": null,
          "dampened_by": null
        }
      ],
      "discounted": [
        {
          "label": "similar colors",
          "signal": "dominant_colors_match",
          "category": "visual",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "screenshot_phash"
        }
      ]
    }
  ],
  "relationships_truncated": false,
  "state": "live"
}