{
  "id": 188,
  "key": "df3aee70a9d3",
  "size": 3,
  "active_count": 3,
  "brands": [
    "microsoft",
    "paypal"
  ],
  "confidence": "suspected cluster",
  "confidence_score": 0.648,
  "confidence_metrics": {
    "B": 0.5,
    "D": 0.359,
    "S": 1.0,
    "T": 0.933,
    "V": 1.0
  },
  "first_seen": "2026-05-12 01:01:16.302445+00:00",
  "last_activity": "2026-05-15 13:01:41.348921+00:00",
  "top_evidence": {
    "type": "cert_fingerprint_exact",
    "coverage": "3/3 members"
  },
  "url": "https://phishunt.io/campaigns/df3aee70a9d3/",
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-08-03T05:00:27.058159+00:00",
  "evidence_summary": [
    {
      "type": "cert_fingerprint_exact",
      "value": "897eb86112360ee4445589437fd72b5f635fbcb414d0edab26a155544271df47",
      "members_matching": 3
    },
    {
      "type": "shared_final_host",
      "value": "training.phriendlyphishing.com",
      "members_matching": 3
    },
    {
      "type": "apex_subdomain_overlap",
      "value": "authorised-support.com",
      "members_matching": 2
    },
    {
      "type": "same_ns_set",
      "value": "ns-1082.awsdns-07.org,ns-1801.awsdns-33.co.uk,ns-327.awsdns-40.com,ns-945.awsdns-54.net",
      "members_matching": 2
    },
    {
      "type": "screenshot_phash_full",
      "value": "956a6b85d8858e3e~946a6a95d8859e3e d=4",
      "members_matching": 2
    },
    {
      "type": "shared_distinctive_token",
      "value": "authorised",
      "members_matching": 2
    },
    {
      "type": "temporal_24h",
      "value": "23.9h",
      "members_matching": 2
    },
    {
      "type": "temporal_72h",
      "value": "60.1h",
      "members_matching": 2
    },
    {
      "type": "temporal_7d",
      "value": "84.0h",
      "members_matching": 2
    }
  ],
  "first_tracked": "2026-08-02T21:40:54.914242+00:00",
  "history": [
    {
      "at": "2026-08-02T21:40:54.914242+00:00",
      "event": "created",
      "size": 3,
      "joined": [
        "microsoft.authorised-support.com",
        "microsoftquarantine.authorised-support.com",
        "paypal.cardpaysecurity.org"
      ],
      "left": []
    }
  ],
  "members": [
    {
      "uuid": "35cf8842-624d-4ec3-9c77-8fc11370fa98",
      "domain": "microsoft.authorised-support.com",
      "url": "https://microsoft.authorised-support.com/new-account/eozafbyj1bjlmgufsilkjjr9kpvsy5kc3uky=3ag==8vvfbsldlv15mz1rxx1fwz09rtfbnsflls09xslw=/6xx5kg1mkrnjeu3rsnc8diftm7r4v1de",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-05-15 13:01:41.348921+00:00",
      "relationship_score": 60,
      "detail_url": "https://phishunt.io/suspicious/microsoft/35cf8842-624d-4ec3-9c77-8fc11370fa98/",
      "image": "screenshots/microsoft/35cf8842-624d-4ec3-9c77-8fc11370fa98.png",
      "phishunt_score": 36,
      "ip": "3.174.46.79",
      "asn": "16509",
      "org": "Amazon.com, Inc.",
      "country": "Germany",
      "registrar": "GoDaddy.com, LLC",
      "cert": "Amazon RSA 2048 M02",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "1"
    },
    {
      "uuid": "ddad91ca-ca75-4e97-9ca2-355d984b3014",
      "domain": "microsoftquarantine.authorised-support.com",
      "url": "http://microsoftquarantine.authorised-support.com/login/review/wjy99urjpywk6fvppin_vx51xfx1jt7x1ueq=7bg==/qvl0fnmnyahdj2smoxwxeggfe1toi_hb",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-05-12 01:01:16.302445+00:00",
      "relationship_score": 60,
      "detail_url": "https://phishunt.io/suspicious/microsoft/ddad91ca-ca75-4e97-9ca2-355d984b3014/",
      "image": "screenshots/microsoft/ddad91ca-ca75-4e97-9ca2-355d984b3014.png",
      "phishunt_score": 34,
      "ip": "3.174.46.92",
      "asn": "16509",
      "org": "Amazon.com, Inc.",
      "country": "Germany",
      "registrar": "GoDaddy.com, LLC",
      "cert": "Amazon RSA 2048 M02",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "1"
    },
    {
      "uuid": "578d09ef-0b0a-4a07-abe3-0407b2875c6e",
      "domain": "paypal.cardpaysecurity.org",
      "url": "http://paypal.cardpaysecurity.org/login/tfkxscsmt_48_qyabrl9ii9hgjwliow24vue=0aq==/kjken0okg_psackvuioa_hbsebtjbuf6",
      "company": "paypal",
      "status": "active",
      "first_seen": "2026-05-14 13:07:27.264947+00:00",
      "relationship_score": 48,
      "detail_url": "https://phishunt.io/suspicious/paypal/578d09ef-0b0a-4a07-abe3-0407b2875c6e/",
      "image": "screenshots/paypal/578d09ef-0b0a-4a07-abe3-0407b2875c6e.png",
      "phishunt_score": 35,
      "ip": "3.174.46.121",
      "asn": "16509",
      "org": "Amazon.com, Inc.",
      "country": "Germany",
      "registrar": "GoDaddy.com, LLC",
      "cert": "Amazon RSA 2048 M02",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "1",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": "1"
    }
  ]
}