{
  "id": 634,
  "key": "61061c550ad7",
  "size": 3,
  "active_count": 3,
  "brands": [
    "coinbase",
    "microsoft",
    "xfinity"
  ],
  "confidence": "suspected cluster",
  "confidence_score": 0.513,
  "confidence_metrics": {
    "B": 0.0,
    "D": 0.483,
    "S": 1.0,
    "T": 0.542,
    "V": 0.75
  },
  "first_seen": "2026-07-07 01:45:37.648989+00:00",
  "last_activity": "2026-08-13 17:52:34.170124+00:00",
  "top_evidence": {
    "type": "same_ip",
    "coverage": "3/3 members"
  },
  "url": "https://phishunt.io/campaigns/61061c550ad7/",
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-09-04T05:00:43.706130+00:00",
  "evidence_summary": [
    {
      "type": "same_ip",
      "value": "198.185.159.144",
      "members_matching": 3
    },
    {
      "type": "screenshot_phash_full",
      "value": "cd9f3be08870e0d9~cd9f3be08c70c0d9 d=2",
      "members_matching": 3
    },
    {
      "type": "favicon_phash_exact",
      "value": "cc91196f0e4a5b5b",
      "members_matching": 3
    },
    {
      "type": "screenshot_phash_full",
      "value": "cd9f3be08c70c0d9~cd9f3be08c70c0d9 d=0",
      "members_matching": 2
    },
    {
      "type": "same_registrar",
      "value": "Squarespace Domains II LLC",
      "members_matching": 2
    }
  ],
  "first_tracked": "2026-09-02T05:00:31.193375+00:00",
  "history": [
    {
      "at": "2026-09-02T05:00:31.193375+00:00",
      "event": "created",
      "size": 3,
      "joined": [
        "helpsecurity-microsoft.com",
        "securedsupport-coinbase.com",
        "xfinitywindowfilms.com"
      ],
      "left": []
    }
  ],
  "members": [
    {
      "uuid": "301d9f55-4ccb-496b-9e58-f7b6b134a669",
      "domain": "helpsecurity-microsoft.com",
      "url": "http://helpsecurity-microsoft.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-07-27 16:03:29.220801+00:00",
      "relationship_score": 51,
      "relationship_tier": "medium",
      "detail_url": "https://phishunt.io/suspicious/microsoft/301d9f55-4ccb-496b-9e58-f7b6b134a669/",
      "image": "screenshots/microsoft/301d9f55-4ccb-496b-9e58-f7b6b134a669.png",
      "phishunt_score": 20,
      "ip": "198.185.159.144",
      "asn": "53831",
      "org": "Squarespace, Inc.",
      "country": "United States",
      "registrar": "Squarespace Domains II LLC",
      "cert": "-",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "1",
      "malicious_urlscan": "0"
    },
    {
      "uuid": "5ab1b47f-1ff3-4b2f-baba-1b0059fca080",
      "domain": "securedsupport-coinbase.com",
      "url": "https://securedsupport-coinbase.com",
      "company": "coinbase",
      "status": "active",
      "first_seen": "2026-07-07 01:45:37.648989+00:00",
      "relationship_score": 51,
      "relationship_tier": "medium",
      "detail_url": "https://phishunt.io/suspicious/coinbase/5ab1b47f-1ff3-4b2f-baba-1b0059fca080/",
      "image": "screenshots/coinbase/5ab1b47f-1ff3-4b2f-baba-1b0059fca080.png",
      "phishunt_score": 19,
      "ip": "198.185.159.144",
      "asn": "53831",
      "org": "Squarespace, Inc.",
      "country": "United States",
      "registrar": "Squarespace Domains II LLC",
      "cert": "Let's Encrypt",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "1"
    },
    {
      "uuid": "4846d944-1b67-48ef-bc77-021d08ff8627",
      "domain": "xfinitywindowfilms.com",
      "url": "https://xfinitywindowfilms.com",
      "company": "xfinity",
      "status": "active",
      "first_seen": "2026-08-13 17:52:34.170124+00:00",
      "relationship_score": 47,
      "relationship_tier": "medium",
      "detail_url": "https://phishunt.io/suspicious/xfinity/4846d944-1b67-48ef-bc77-021d08ff8627/",
      "image": "screenshots/xfinity/4846d944-1b67-48ef-bc77-021d08ff8627.png",
      "phishunt_score": 20,
      "ip": "198.185.159.144",
      "asn": "53831",
      "org": "Squarespace, Inc.",
      "country": "United States",
      "registrar": "Squarespace Domains LLC",
      "cert": "Let's Encrypt",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "1"
    }
  ],
  "relationships": [
    {
      "domain_a": "helpsecurity-microsoft.com",
      "domain_b": "securedsupport-coinbase.com",
      "detail_url_a": "https://phishunt.io/suspicious/microsoft/301d9f55-4ccb-496b-9e58-f7b6b134a669/",
      "detail_url_b": "https://phishunt.io/suspicious/coinbase/5ab1b47f-1ff3-4b2f-baba-1b0059fca080/",
      "score": 51,
      "tier": "medium",
      "demotion_reason": null,
      "first_reproduced": "2026-07-28",
      "evidence": [
        {
          "label": "same IP",
          "signal": "same_ip",
          "category": "infra",
          "contributed": 22.0,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same screenshot",
          "signal": "screenshot_phash_full",
          "category": "visual",
          "contributed": 13.3,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same favicon",
          "signal": "favicon_phash_exact",
          "category": "visual",
          "contributed": 11.7,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same registrar",
          "signal": "same_registrar",
          "category": "registration",
          "contributed": 4,
          "idf_factor": null,
          "dampened_by": null
        }
      ],
      "discounted": [
        {
          "label": "same ASN",
          "signal": "same_asn",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "same hosting org",
          "signal": "same_org",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "similar colors",
          "signal": "dominant_colors_match",
          "category": "visual",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "screenshot_phash"
        }
      ]
    },
    {
      "domain_a": "helpsecurity-microsoft.com",
      "domain_b": "xfinitywindowfilms.com",
      "detail_url_a": "https://phishunt.io/suspicious/microsoft/301d9f55-4ccb-496b-9e58-f7b6b134a669/",
      "detail_url_b": "https://phishunt.io/suspicious/xfinity/4846d944-1b67-48ef-bc77-021d08ff8627/",
      "score": 47,
      "tier": "medium",
      "demotion_reason": null,
      "first_reproduced": "2026-08-14",
      "evidence": [
        {
          "label": "same IP",
          "signal": "same_ip",
          "category": "infra",
          "contributed": 22.0,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same screenshot",
          "signal": "screenshot_phash_full",
          "category": "visual",
          "contributed": 13.3,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same favicon",
          "signal": "favicon_phash_exact",
          "category": "visual",
          "contributed": 11.7,
          "idf_factor": 1.0,
          "dampened_by": null
        }
      ],
      "discounted": [
        {
          "label": "same ASN",
          "signal": "same_asn",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "same hosting org",
          "signal": "same_org",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "similar colors",
          "signal": "dominant_colors_match",
          "category": "visual",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "screenshot_phash"
        }
      ]
    },
    {
      "domain_a": "securedsupport-coinbase.com",
      "domain_b": "xfinitywindowfilms.com",
      "detail_url_a": "https://phishunt.io/suspicious/coinbase/5ab1b47f-1ff3-4b2f-baba-1b0059fca080/",
      "detail_url_b": "https://phishunt.io/suspicious/xfinity/4846d944-1b67-48ef-bc77-021d08ff8627/",
      "score": 47,
      "tier": "medium",
      "demotion_reason": null,
      "first_reproduced": "2026-08-14",
      "evidence": [
        {
          "label": "same IP",
          "signal": "same_ip",
          "category": "infra",
          "contributed": 22.0,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same screenshot",
          "signal": "screenshot_phash_full",
          "category": "visual",
          "contributed": 13.3,
          "idf_factor": 1.0,
          "dampened_by": null
        },
        {
          "label": "same favicon",
          "signal": "favicon_phash_exact",
          "category": "visual",
          "contributed": 11.7,
          "idf_factor": 1.0,
          "dampened_by": null
        }
      ],
      "discounted": [
        {
          "label": "same ASN",
          "signal": "same_asn",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "same hosting org",
          "signal": "same_org",
          "category": "infra",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "same_ip"
        },
        {
          "label": "similar colors",
          "signal": "dominant_colors_match",
          "category": "visual",
          "contributed": 0.0,
          "idf_factor": null,
          "dampened_by": "screenshot_phash"
        }
      ]
    }
  ],
  "relationships_truncated": false,
  "state": "live"
}