{
  "id": 290,
  "key": "a1e6fc257403",
  "size": 4,
  "active_count": 4,
  "brands": [
    "apple"
  ],
  "confidence": "possible campaign",
  "confidence_score": 0.743,
  "confidence_metrics": {
    "B": 0.333,
    "D": 0.576,
    "S": 1.0,
    "T": 1.0,
    "V": 1.0
  },
  "first_seen": "2026-08-11 01:01:12.274646+00:00",
  "last_activity": "2026-08-11 01:01:38.806570+00:00",
  "top_evidence": {
    "type": "ocr_similarity_full",
    "coverage": "4/4 members"
  },
  "url": "https://phishunt.io/campaigns/a1e6fc257403/",
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-08-11T05:00:27.561793+00:00",
  "evidence_summary": [
    {
      "type": "ocr_similarity_full",
      "value": "jaccard=1.00",
      "members_matching": 4
    },
    {
      "type": "same_ip",
      "value": "108.167.146.200",
      "members_matching": 4
    },
    {
      "type": "screenshot_phash_full",
      "value": "f777888f8c203399~f777888f8c203399 d=0",
      "members_matching": 4
    },
    {
      "type": "shared_final_host",
      "value": "www.icloud.com",
      "members_matching": 4
    },
    {
      "type": "temporal_24h",
      "value": "0.0h",
      "members_matching": 4
    },
    {
      "type": "apex_subdomain_overlap",
      "value": "icloudfind.live",
      "members_matching": 2
    },
    {
      "type": "apex_subdomain_overlap",
      "value": "sa.com",
      "members_matching": 2
    },
    {
      "type": "domain_age_window",
      "value": "1d/1d",
      "members_matching": 2
    },
    {
      "type": "same_ns_set",
      "value": "cns43.webhostbox.net,cns44.webhostbox.net",
      "members_matching": 2
    },
    {
      "type": "same_ns_set",
      "value": "ns1.centralnic.net,ns2.centralnic.net,ns3.centralnic.net,ns4.centralnic.net",
      "members_matching": 2
    },
    {
      "type": "same_registrar",
      "value": "EuroDNS S.A.",
      "members_matching": 2
    },
    {
      "type": "same_registrar",
      "value": "Sav.com, LLC",
      "members_matching": 2
    },
    {
      "type": "shared_distinctive_token",
      "value": "icloudfind",
      "members_matching": 2
    },
    {
      "type": "shared_distinctive_token",
      "value": "icloud",
      "members_matching": 2
    }
  ],
  "first_tracked": "2026-08-11T05:00:27.561793+00:00",
  "history": [
    {
      "at": "2026-08-11T05:00:27.561793+00:00",
      "event": "created",
      "size": 4,
      "joined": [
        "icloudfind.live",
        "mail.icloudfind.live",
        "mail.signin-icloud.sa.com",
        "signin-icloud.sa.com"
      ],
      "left": []
    }
  ],
  "members": [
    {
      "uuid": "9dae0dc2-567e-4ab7-a857-78d0cb170ee3",
      "domain": "icloudfind.live",
      "url": "http://icloudfind.live/fl26",
      "company": "apple",
      "status": "active",
      "first_seen": "2026-08-11 01:01:17.658787+00:00",
      "relationship_score": 74,
      "detail_url": "https://phishunt.io/suspicious/apple/9dae0dc2-567e-4ab7-a857-78d0cb170ee3/",
      "image": "screenshots/apple/a872d086-6777-4bcb-b428-25f640ac7bda.png",
      "phishunt_score": 40,
      "ip": "108.167.146.200",
      "asn": "31898",
      "org": "Oracle Corporation",
      "country": "United States",
      "registrar": "EuroDNS S.A.",
      "cert": "-",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "0"
    },
    {
      "uuid": "e883b210-6d5e-4bed-a3cc-c7836fc59f56",
      "domain": "mail.icloudfind.live",
      "url": "https://mail.icloudfind.live/fl26",
      "company": "apple",
      "status": "active",
      "first_seen": "2026-08-11 01:01:12.274646+00:00",
      "relationship_score": 74,
      "detail_url": "https://phishunt.io/suspicious/apple/e883b210-6d5e-4bed-a3cc-c7836fc59f56/",
      "image": "screenshots/apple/6bb77406-b57f-4cc3-bc2d-a9345a9c6441.png",
      "phishunt_score": 40,
      "ip": "108.167.146.200",
      "asn": "31898",
      "org": "Oracle Corporation",
      "country": "United States",
      "registrar": "EuroDNS S.A.",
      "cert": "-",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "0"
    },
    {
      "uuid": "6bd4f56c-0f87-4a6f-96d1-65cdb5748f9b",
      "domain": "mail.signin-icloud.sa.com",
      "url": "https://mail.signin-icloud.sa.com/fl26",
      "company": "apple",
      "status": "active",
      "first_seen": "2026-08-11 01:01:20.854864+00:00",
      "relationship_score": 64,
      "detail_url": "https://phishunt.io/suspicious/apple/6bd4f56c-0f87-4a6f-96d1-65cdb5748f9b/",
      "image": "screenshots/apple/cbfcdedf-57a3-4fe0-9d22-8715cd4b582c.png",
      "phishunt_score": 30,
      "ip": "108.167.146.200",
      "asn": "31898",
      "org": "Oracle Corporation",
      "country": "United States",
      "registrar": "Sav.com, LLC",
      "cert": "-",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "0"
    },
    {
      "uuid": "b9a97a11-926a-4078-94b6-c4a2ce9d7aab",
      "domain": "signin-icloud.sa.com",
      "url": "http://signin-icloud.sa.com/fl26",
      "company": "apple",
      "status": "active",
      "first_seen": "2026-08-11 01:01:38.806570+00:00",
      "relationship_score": 64,
      "detail_url": "https://phishunt.io/suspicious/apple/b9a97a11-926a-4078-94b6-c4a2ce9d7aab/",
      "image": "screenshots/apple/7bc31e94-dc05-4914-bf4b-db75fd3f1be2.png",
      "phishunt_score": 30,
      "ip": "108.167.146.200",
      "asn": "31898",
      "org": "Oracle Corporation",
      "country": "United States",
      "registrar": "Sav.com, LLC",
      "cert": "-",
      "gsb_category": "",
      "malicious_google": "0",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "0"
    }
  ]
}