{
  "id": 249,
  "key": "f2b89aafdfff",
  "size": 4,
  "active_count": 4,
  "brands": [
    "santander"
  ],
  "confidence": "suspected cluster",
  "confidence_score": 0.591,
  "confidence_metrics": {
    "B": 0.0,
    "D": 0.477,
    "S": 1.0,
    "T": 0.944,
    "V": 0.75
  },
  "first_seen": "2026-08-05 05:27:31.736322+00:00",
  "last_activity": "2026-08-07 17:27:25.574629+00:00",
  "top_evidence": {
    "type": "apex_subdomain_overlap",
    "coverage": "4/4 members"
  },
  "url": "https://phishunt.io/campaigns/f2b89aafdfff/",
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-08-08T05:00:27.694033+00:00",
  "evidence_summary": [
    {
      "type": "apex_subdomain_overlap",
      "value": "duckdns.org",
      "members_matching": 4
    },
    {
      "type": "same_ip",
      "value": "195.234.4.57",
      "members_matching": 4
    },
    {
      "type": "same_ns_set",
      "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
      "members_matching": 4
    },
    {
      "type": "same_registrar",
      "value": "Gandi SAS",
      "members_matching": 4
    },
    {
      "type": "shared_distinctive_token",
      "value": "bimp",
      "members_matching": 4
    },
    {
      "type": "temporal_24h",
      "value": "0.0h",
      "members_matching": 4
    },
    {
      "type": "temporal_72h",
      "value": "60.0h",
      "members_matching": 4
    },
    {
      "type": "shared_distinctive_token",
      "value": "wccheck",
      "members_matching": 3
    },
    {
      "type": "shared_distinctive_token",
      "value": "0209014e",
      "members_matching": 2
    }
  ],
  "first_tracked": "2026-08-08T05:00:27.694033+00:00",
  "history": [
    {
      "at": "2026-08-08T05:00:27.694033+00:00",
      "event": "created",
      "size": 4,
      "joined": [
        "ewlpnkrg.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
        "ewlpnkrg.www.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
        "login.rmdbwskx.santander.bimp-bot.duckdns.org",
        "login.wccheck-b18ca936-a.santander.bimp-bot.duckdns.org"
      ],
      "left": []
    }
  ],
  "members": [
    {
      "uuid": "d371b197-ebdd-467d-8a2b-dcac979b46c2",
      "domain": "ewlpnkrg.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "url": "https://ewlpnkrg.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-05 05:27:31.736322+00:00",
      "relationship_score": 50,
      "detail_url": "https://phishunt.io/suspicious/santander/d371b197-ebdd-467d-8a2b-dcac979b46c2/",
      "image": "",
      "phishunt_score": 36,
      "ip": "195.234.4.57",
      "asn": "51734",
      "org": "HOSTLAB LLC",
      "country": "Ukraine",
      "registrar": "Gandi SAS",
      "cert": "-",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": ""
    },
    {
      "uuid": "9c728943-8728-4102-a4ab-b806081e4bd4",
      "domain": "ewlpnkrg.www.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "url": "https://ewlpnkrg.www.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-05 05:27:31.802821+00:00",
      "relationship_score": 50,
      "detail_url": "https://phishunt.io/suspicious/santander/9c728943-8728-4102-a4ab-b806081e4bd4/",
      "image": "",
      "phishunt_score": 36,
      "ip": "195.234.4.57",
      "asn": "51734",
      "org": "HOSTLAB LLC",
      "country": "Ukraine",
      "registrar": "Gandi SAS",
      "cert": "-",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": ""
    },
    {
      "uuid": "4466ee66-95d8-4787-aa29-9987c06d1e34",
      "domain": "login.rmdbwskx.santander.bimp-bot.duckdns.org",
      "url": "https://login.rmdbwskx.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-07 17:27:20.384080+00:00",
      "relationship_score": 48,
      "detail_url": "https://phishunt.io/suspicious/santander/4466ee66-95d8-4787-aa29-9987c06d1e34/",
      "image": "",
      "phishunt_score": 36,
      "ip": "195.234.4.57",
      "asn": "51734",
      "org": "HOSTLAB LLC",
      "country": "Ukraine",
      "registrar": "Gandi SAS",
      "cert": "-",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": ""
    },
    {
      "uuid": "eae29de0-315e-41e6-9cf7-46d7dcf32858",
      "domain": "login.wccheck-b18ca936-a.santander.bimp-bot.duckdns.org",
      "url": "https://login.wccheck-b18ca936-a.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-07 17:27:25.574629+00:00",
      "relationship_score": 48,
      "detail_url": "https://phishunt.io/suspicious/santander/eae29de0-315e-41e6-9cf7-46d7dcf32858/",
      "image": "",
      "phishunt_score": 36,
      "ip": "195.234.4.57",
      "asn": "51734",
      "org": "HOSTLAB LLC",
      "country": "Ukraine",
      "registrar": "Gandi SAS",
      "cert": "-",
      "gsb_category": "SOCIAL_ENGINEERING",
      "malicious_google": "1",
      "malicious_openphish": "0",
      "malicious_phishtank": "0",
      "malicious_tweetfeed": "0",
      "malicious_urlscan": ""
    }
  ]
}