{
  "uuid": "06f255f7-5cd6-483d-b436-2bf7e3489217",
  "domain": "office.folder-onedrive-live.com",
  "algorithm_version": "corr-1.4.0",
  "generated_at": "2026-10-30T05:00:48.223307+00:00",
  "cluster": null,
  "count": 1,
  "limit": 10,
  "results": [
    {
      "uuid": "7e662b18-bdc8-4510-a030-5cdd89b942db",
      "domain": "autologon.folder-onedrive-live.com",
      "url": "https://autologon.folder-onedrive-live.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-29 23:23:09.355366+00:00",
      "relationship_score": 76,
      "evidence": [
        {
          "type": "apex_subdomain_overlap",
          "value": "folder-onedrive-live.com",
          "contributed": 10.0
        },
        {
          "type": "same_ns_set",
          "value": "hans.ns.cloudflare.com,lisa.ns.cloudflare.com",
          "contributed": 14.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "folder",
          "contributed": 10.0
        },
        {
          "type": "domain_age_window",
          "value": "1d/1d",
          "contributed": 5
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "1d/1d",
          "contributed": 3
        },
        {
          "type": "san_overlap",
          "value": "folder-onedrive-live.com",
          "contributed": 12.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "bfd9c0e6c8d9c260~bfd9c0e6c8d9c064 d=2",
          "contributed": 16.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/7e662b18-bdc8-4510-a030-5cdd89b942db/",
      "service_range": {
        "best": {
          "direction": "both",
          "kind": "hosting",
          "kind_label": "rentable cloud hosting",
          "prefix": "18.208.0.0/13",
          "provider": "AWS",
          "region": "us-east-1",
          "service": "EC2",
          "source": "aws"
        },
        "also": [],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      }
    }
  ]
}