{ "id": 1035, "key": "5d708ff9078b", "size": 9, "host_count": 9, "active_count": 9, "brands": [ "whatsapp" ], "confidence": "suspected cluster", "confidence_score": 0.665, "confidence_metrics": { "B": 0.0, "D": 0.478, "S": 1.0, "T": 1.0, "V": 1.0 }, "first_seen": "2026-10-20 22:42:54.939362+00:00", "last_activity": "2026-10-20 23:02:42.053348+00:00", "top_evidence": { "type": "ocr_similarity_full", "coverage": "9/9 members" }, "url": "https://phishunt.io/campaigns/5d708ff9078b/", "algorithm_version": "corr-1.4.0", "generated_at": "2026-10-27T05:00:45.363892+00:00", "evidence_summary": [ { "type": "ocr_similarity_full", "value": "jaccard=0.92", "members_matching": 9 }, { "type": "same_template", "value": "aaa-aaaaaaaa", "members_matching": 9 }, { "type": "temporal_24h", "value": "0.1h", "members_matching": 9 }, { "type": "temporal_24h", "value": "0.2h", "members_matching": 9 }, { "type": "domain_age_window", "value": "7d/7d", "members_matching": 9 }, { "type": "cert_age_window", "value": "3d/3d", "members_matching": 9 }, { "type": "temporal_24h", "value": "0.0h", "members_matching": 8 }, { "type": "ocr_similarity_full", "value": "jaccard=0.93", "members_matching": 7 }, { "type": "ocr_similarity_full", "value": "jaccard=0.97", "members_matching": 7 }, { "type": "ocr_similarity_full", "value": "jaccard=0.98", "members_matching": 7 }, { "type": "ocr_similarity_full", "value": "jaccard=0.95", "members_matching": 6 }, { "type": "screenshot_phash_full", "value": "b5ca352e4a94e66a~b5ca342eca94a66e d=4", "members_matching": 5 }, { "type": "screenshot_phash_full", "value": "b5ca352e4e94e26a~b5ca342eca94a66e d=6", "members_matching": 5 }, { "type": "ocr_similarity_full", "value": "jaccard=1.00", "members_matching": 5 }, { "type": "temporal_24h", "value": "0.3h", "members_matching": 5 }, { "type": "screenshot_phash_full", "value": "b5ca352e4a94e66a~b5ca352e4e94e26a d=2", "members_matching": 4 }, { "type": "screenshot_phash_full", "value": "b5ca342eca94e66a~b5ca342eca94a66e d=2", "members_matching": 4 }, { "type": "ocr_similarity_full", "value": "jaccard=0.89", "members_matching": 4 }, { "type": "screenshot_phash_full", "value": "b5ca352e4a94e66a~b5ca342eca94e66a d=2", "members_matching": 3 }, { "type": "screenshot_phash_full", "value": "b5ca352e4e94e26a~b5ca342eca94e66a d=4", "members_matching": 3 }, { "type": "screenshot_phash_full", "value": "b5ca342e4e94e66a~b5ca342eca94a66e d=4", "members_matching": 3 }, { "type": "screenshot_phash_full", "value": "b5ca352e4a94e66a~b5ca342e4e94e66a d=2", "members_matching": 3 }, { "type": "screenshot_phash_full", "value": "b5ca352e4e94e26a~b5ca342e4e94e66a d=2", "members_matching": 3 }, { "type": "screenshot_phash_full", "value": "b5ca342eca94a66e~b5ca342eca94a66e d=0", "members_matching": 3 }, { "type": "ocr_similarity_full", "value": "jaccard=0.90", "members_matching": 3 }, { "type": "screenshot_phash_full", "value": "b5ca352e4a94e66a~b5ca352e4a94e66a d=0", "members_matching": 2 }, { "type": "screenshot_phash_full", "value": "b5ca342eca94e66a~b5ca342e4e94e66a d=2", "members_matching": 2 }, { "type": "screenshot_phash_full", "value": "b5ca352e4e94e26a~b5ca352e4e94e26a d=0", "members_matching": 2 }, { "type": "screenshot_phash_full", "value": "b5ca342eca94a66e~b5ca342e4e94e66a d=4", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~bnn-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~bor-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnn-whatsapp~bor-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~bnk-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~bnv-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnk-whatsapp~bnn-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnk-whatsapp~bnv-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnn-whatsapp~bnv-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "boo-whatsapp~bor-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~boo-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnk-whatsapp~boo-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnk-whatsapp~bor-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnn-whatsapp~boo-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnv-whatsapp~boo-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnv-whatsapp~bor-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~bnl-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~bnx-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnk-whatsapp~bnl-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnk-whatsapp~bnx-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnl-whatsapp~bnn-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnl-whatsapp~bnv-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnl-whatsapp~bnx-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnl-whatsapp~boo-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnl-whatsapp~bor-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnn-whatsapp~bnx-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnv-whatsapp~bnx-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnx-whatsapp~boo-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnx-whatsapp~bor-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bna-whatsapp~bop-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnk-whatsapp~bop-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnl-whatsapp~bop-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnn-whatsapp~bop-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnv-whatsapp~bop-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bnx-whatsapp~bop-whatsapp d=2", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "boo-whatsapp~bop-whatsapp d=1", "members_matching": 2 }, { "type": "levenshtein_le2", "value": "bop-whatsapp~bor-whatsapp d=1", "members_matching": 2 } ], "first_tracked": "2026-10-26T05:00:40.818090+00:00", "history": [ { "at": "2026-10-27T05:00:45.363892+00:00", "event": "grew", "size": 9, "joined": [ "bop-whatsapp.com" ], "left": [] }, { "at": "2026-10-26T05:00:40.818090+00:00", "event": "created", "size": 8, "joined": [ "bna-whatsapp.com", "bnk-whatsapp.com", "bnl-whatsapp.com", "bnn-whatsapp.com", "bnv-whatsapp.com", "bnx-whatsapp.com", "boo-whatsapp.com", "bor-whatsapp.com" ], "left": [] } ], "members": [ { "uuid": "5aebd9e8-b33c-4acb-a41c-0b138351fc2d", "domain": "bna-whatsapp.com", "registrable_domain": "bna-whatsapp.com", "url": "http://bna-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 22:42:54.939362+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "image": "screenshots/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "3b8df46a-ddd8-4f84-8b17-6431c6abd090", "domain": "bnk-whatsapp.com", "registrable_domain": "bnk-whatsapp.com", "url": "http://bnk-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 22:47:39.328398+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "image": "screenshots/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "2d84edd2-3ea5-41d4-85d6-12b10ee28084", "domain": "bnl-whatsapp.com", "registrable_domain": "bnl-whatsapp.com", "url": "http://bnl-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 22:48:07.301238+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "image": "screenshots/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR2", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "4b81fdc5-422e-456a-b144-9e2c7f0bc9a8", "domain": "bnn-whatsapp.com", "registrable_domain": "bnn-whatsapp.com", "url": "http://bnn-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 22:49:04.447041+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "image": "screenshots/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR2", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "7961f6f0-c6d0-4027-ab13-2eacef4e07fe", "domain": "bnv-whatsapp.com", "registrable_domain": "bnv-whatsapp.com", "url": "http://bnv-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 22:53:03.534185+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "image": "screenshots/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "ce26f64f-dfd0-4a9e-a3ae-656846ad385c", "domain": "bnx-whatsapp.com", "registrable_domain": "bnx-whatsapp.com", "url": "http://bnx-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 22:53:52.049177+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "image": "screenshots/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "db5c2f88-c887-4773-91f4-74830820c127", "domain": "boo-whatsapp.com", "registrable_domain": "boo-whatsapp.com", "url": "http://boo-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 23:01:32.323127+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "image": "screenshots/whatsapp/db5c2f88-c887-4773-91f4-74830820c127.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "c424968c-b25d-4b4b-87d7-0c82ec0912dd", "domain": "bop-whatsapp.com", "registrable_domain": "bop-whatsapp.com", "url": "http://bop-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 23:02:11.423637+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "image": "screenshots/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR2", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" }, { "uuid": "780a7c7c-9a91-4bc2-a86a-3daeeb790b45", "domain": "bor-whatsapp.com", "registrable_domain": "bor-whatsapp.com", "url": "http://bor-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-10-20 23:02:42.053348+00:00", "relationship_score": 48, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "image": "screenshots/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45.png", "phishunt_score": 30, "ip": "156.234.58.242", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "GKG.Net, Inc.", "cert": "YR2", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "1", "malicious_urlscan": "0" } ], "domains": [ { "domain": "bna-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bna-whatsapp.com" ], "uuids": [ "5aebd9e8-b33c-4acb-a41c-0b138351fc2d" ] }, { "domain": "bnk-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bnk-whatsapp.com" ], "uuids": [ "3b8df46a-ddd8-4f84-8b17-6431c6abd090" ] }, { "domain": "bnl-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bnl-whatsapp.com" ], "uuids": [ "2d84edd2-3ea5-41d4-85d6-12b10ee28084" ] }, { "domain": "bnn-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bnn-whatsapp.com" ], "uuids": [ "4b81fdc5-422e-456a-b144-9e2c7f0bc9a8" ] }, { "domain": "bnv-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bnv-whatsapp.com" ], "uuids": [ "7961f6f0-c6d0-4027-ab13-2eacef4e07fe" ] }, { "domain": "bnx-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bnx-whatsapp.com" ], "uuids": [ "ce26f64f-dfd0-4a9e-a3ae-656846ad385c" ] }, { "domain": "boo-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "boo-whatsapp.com" ], "uuids": [ "db5c2f88-c887-4773-91f4-74830820c127" ] }, { "domain": "bop-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bop-whatsapp.com" ], "uuids": [ "c424968c-b25d-4b4b-87d7-0c82ec0912dd" ] }, { "domain": "bor-whatsapp.com", "host_count": 1, "active_count": 1, "hosts": [ "bor-whatsapp.com" ], "uuids": [ "780a7c7c-9a91-4bc2-a86a-3daeeb790b45" ] } ], "relationships": [ { "domain_a": "bna-whatsapp.com", "domain_b": "bnk-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bna-whatsapp.com", "domain_b": "bnl-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bna-whatsapp.com", "domain_b": "bnn-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-23", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bna-whatsapp.com", "domain_b": "bnv-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bna-whatsapp.com", "domain_b": "bnx-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bna-whatsapp.com", "domain_b": "boo-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bna-whatsapp.com", "domain_b": "bop-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bna-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/5aebd9e8-b33c-4acb-a41c-0b138351fc2d/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-24", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnk-whatsapp.com", "domain_b": "bnl-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnk-whatsapp.com", "domain_b": "bnn-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnk-whatsapp.com", "domain_b": "bnv-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnk-whatsapp.com", "domain_b": "bnx-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnk-whatsapp.com", "domain_b": "boo-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnk-whatsapp.com", "domain_b": "bop-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnk-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3b8df46a-ddd8-4f84-8b17-6431c6abd090/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnl-whatsapp.com", "domain_b": "bnn-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnl-whatsapp.com", "domain_b": "bnv-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnl-whatsapp.com", "domain_b": "bnx-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnl-whatsapp.com", "domain_b": "boo-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnl-whatsapp.com", "domain_b": "bop-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnl-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/2d84edd2-3ea5-41d4-85d6-12b10ee28084/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnn-whatsapp.com", "domain_b": "bnv-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnn-whatsapp.com", "domain_b": "bnx-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnn-whatsapp.com", "domain_b": "boo-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnn-whatsapp.com", "domain_b": "bop-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnn-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4b81fdc5-422e-456a-b144-9e2c7f0bc9a8/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-24", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnv-whatsapp.com", "domain_b": "bnx-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnv-whatsapp.com", "domain_b": "boo-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnv-whatsapp.com", "domain_b": "bop-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnv-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/7961f6f0-c6d0-4027-ab13-2eacef4e07fe/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnx-whatsapp.com", "domain_b": "boo-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnx-whatsapp.com", "domain_b": "bop-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bnx-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/ce26f64f-dfd0-4a9e-a3ae-656846ad385c/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-26", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "boo-whatsapp.com", "domain_b": "bop-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "boo-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/db5c2f88-c887-4773-91f4-74830820c127/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "bop-whatsapp.com", "domain_b": "bor-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/c424968c-b25d-4b4b-87d7-0c82ec0912dd/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/780a7c7c-9a91-4bc2-a86a-3daeeb790b45/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-10-27", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "levenshtein_le2", "category": "naming", "contributed": 9.0, "idf_factor": null, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "similar name", "signal": "same_template", "category": "naming", "contributed": 6.0, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] } ], "relationships_truncated": false, "state": "live" }