{
  "id": 189,
  "key": "40bef666f218",
  "size": 3,
  "active_count": 3,
  "brands": [
    "microsoft"
  ],
  "confidence": "suspected cluster",
  "confidence_score": 0.597,
  "confidence_metrics": {
    "B": 0.667,
    "D": 0.623,
    "S": 1.0,
    "T": 0.0,
    "V": 1.0
  },
  "first_seen": "2026-03-28 13:01:22.118172+00:00",
  "last_activity": "2026-06-08 13:01:32.485411+00:00",
  "top_evidence": {
    "type": "apex_subdomain_overlap",
    "coverage": "3/3 members"
  },
  "url": "https://phishunt.io/campaigns/40bef666f218/",
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-08-03T05:00:27.058159+00:00",
  "evidence_summary": [
    {
      "type": "apex_subdomain_overlap",
      "value": "m365-microsoft.com",
      "members_matching": 3
    },
    {
      "type": "cert_fingerprint_exact",
      "value": "747cef48fe4c39e1512b3afa2438066e0785066cbe7d04f869a240d3a7cd42c9",
      "members_matching": 3
    },
    {
      "type": "favicon_phash_exact",
      "value": "97da6c23cbcc9492",
      "members_matching": 3
    },
    {
      "type": "same_ns_set",
      "value": "ns1-36.azure-dns.com,ns2-36.azure-dns.net,ns3-36.azure-dns.org,ns4-36.azure-dns.info",
      "members_matching": 3
    },
    {
      "type": "shared_distinctive_token",
      "value": "m365",
      "members_matching": 3
    },
    {
      "type": "screenshot_phash_full",
      "value": "e6999964339b4ccc~e699d964339364cc d=4",
      "members_matching": 2
    },
    {
      "type": "temporal_72h",
      "value": "60.0h",
      "members_matching": 2
    }
  ],
  "first_tracked": "2026-07-18T19:36:44.997352+00:00",
  "history": [
    {
      "at": "2026-07-18T21:03:07.782567+00:00",
      "event": "shrank",
      "size": 3,
      "joined": [],
      "left": [
        "office365.internal-alerts.com",
        "office365.rricrosoft-offices.org"
      ]
    },
    {
      "at": "2026-07-18T19:36:44.997352+00:00",
      "event": "created",
      "size": 5,
      "joined": [
        "office365.internal-alerts.com",
        "office365.rricrosoft-offices.org",
        "programme-hup.m365-microsoft.com",
        "security.m365-microsoft.com",
        "support.m365-microsoft.com"
      ],
      "left": []
    }
  ],
  "members": [
    {
      "uuid": "872fb8e2-403a-45ce-b2dc-518ebacf7fab",
      "domain": "programme-hup.m365-microsoft.com",
      "url": "https://programme-hup.m365-microsoft.com/i/d721e212eb3094bfd99c9d047a94edaeb",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-06-08 13:01:32.485411+00:00",
      "relationship_score": 60,
      "detail_url": "https://phishunt.io/suspicious/microsoft/872fb8e2-403a-45ce-b2dc-518ebacf7fab/",
      "image": "screenshots/microsoft/872fb8e2-403a-45ce-b2dc-518ebacf7fab.png",
      "phishunt_score": 27,
      "ip": "20.50.64.14",
      "asn": "8075",
      "org": "Microsoft Corporation",
      "country": "Ireland",
      "registrar": "Dynadot Inc",
      "cert": "R13",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "1"
    },
    {
      "uuid": "d5cb6a39-23cf-49f4-a25e-0ffd83801c0f",
      "domain": "security.m365-microsoft.com",
      "url": "http://security.m365-microsoft.com/i/d51ee024a6cb3468996ec7c9307051d1d",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-06-06 01:02:06.184550+00:00",
      "relationship_score": 70,
      "detail_url": "https://phishunt.io/suspicious/microsoft/d5cb6a39-23cf-49f4-a25e-0ffd83801c0f/",
      "image": "screenshots/microsoft/d5cb6a39-23cf-49f4-a25e-0ffd83801c0f.png",
      "phishunt_score": 35,
      "ip": "20.50.64.14",
      "asn": "8075",
      "org": "Microsoft Corporation",
      "country": "Ireland",
      "registrar": "Dynadot Inc",
      "cert": "R13",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "1"
    },
    {
      "uuid": "4484f1cb-d3da-4757-83a3-5596fb6c36a2",
      "domain": "support.m365-microsoft.com",
      "url": "http://support.m365-microsoft.com/i/ab041e84e499243eca3e98fb328201632",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-03-28 13:01:22.118172+00:00",
      "relationship_score": 70,
      "detail_url": "https://phishunt.io/suspicious/microsoft/4484f1cb-d3da-4757-83a3-5596fb6c36a2/",
      "image": "screenshots/microsoft/4484f1cb-d3da-4757-83a3-5596fb6c36a2.png",
      "phishunt_score": 23,
      "ip": "20.50.64.14",
      "asn": "8075",
      "org": "Microsoft Corporation",
      "country": "Ireland",
      "registrar": "Dynadot Inc",
      "cert": "R13",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "0"
    }
  ]
}