{
  "uuid": "1e7398ca-40de-441c-a84b-d0a5e25a9cc8",
  "domain": "correoscri.cc",
  "algorithm_version": "corr-1.4.0",
  "generated_at": "2026-10-23T05:00:45.889211+00:00",
  "cluster": {
    "key": "0a12ee5e7e96",
    "size": 3,
    "host_count": 3,
    "url": "https://phishunt.io/campaigns/0a12ee5e7e96/"
  },
  "count": 2,
  "limit": 10,
  "results": [
    {
      "uuid": "6bcbabeb-fe30-4ee6-8b95-dda7f1b94e26",
      "domain": "correosccl.cc",
      "url": "https://correosccl.cc",
      "company": "correos",
      "status": "active",
      "first_seen": "2026-09-20 23:25:54.938160+00:00",
      "relationship_score": 49,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=0.98",
          "contributed": 6.0
        },
        {
          "type": "same_ns_set",
          "value": "isabel.ns.cloudflare.com,jose.ns.cloudflare.com",
          "contributed": 11.2
        },
        {
          "type": "levenshtein_le2",
          "value": "correoscri~correosccl d=2",
          "contributed": 12
        },
        {
          "type": "same_registrar",
          "value": "Dominet (HK) Limited",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "bcd9c3cb63281c69~bcd9c3cb63281c69 d=0",
          "contributed": 16.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/correos/6bcbabeb-fe30-4ee6-8b95-dda7f1b94e26/",
      "service_range": {
        "best": {
          "direction": "both",
          "kind": "platform",
          "kind_label": "shared platform that serves customer content",
          "prefix": "172.64.0.0/13",
          "provider": "Cloudflare",
          "region": "",
          "service": "CDN",
          "source": "cloudflare"
        },
        "also": [],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      }
    },
    {
      "uuid": "2c775544-dc9a-47cb-9e08-9c196ee9dc17",
      "domain": "correosiicr.cc",
      "url": "https://correosiicr.cc",
      "company": "correos",
      "status": "active",
      "first_seen": "2026-09-01 05:24:22.784199+00:00",
      "relationship_score": 46,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=0.98",
          "contributed": 6.0
        },
        {
          "type": "same_ns_set",
          "value": "isabel.ns.cloudflare.com,jose.ns.cloudflare.com",
          "contributed": 11.2
        },
        {
          "type": "same_registrar",
          "value": "Dominet (HK) Limited",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "favicon_phash_exact",
          "value": "bec8c1363ec9c136",
          "contributed": 11.7
        },
        {
          "type": "screenshot_phash_full",
          "value": "bcd9c3cb63281c69~bcd9c3cb63281c69 d=0",
          "contributed": 13.3
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/correos/2c775544-dc9a-47cb-9e08-9c196ee9dc17/",
      "service_range": {
        "best": {
          "direction": "both",
          "kind": "platform",
          "kind_label": "shared platform that serves customer content",
          "prefix": "172.64.0.0/13",
          "provider": "Cloudflare",
          "region": "",
          "service": "CDN",
          "source": "cloudflare"
        },
        "also": [],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      }
    }
  ]
}