{
  "uuid": "2267acb7-421a-4c91-a791-1e2a8b1f2e27",
  "domain": "comomypal-securityserver.netflixconfirmation.net1fc.smtp.test.bimp-bot.duckdns.org",
  "algorithm_version": "corr-1.4.0",
  "generated_at": "2026-10-20T05:00:33.134151+00:00",
  "cluster": null,
  "count": 7,
  "limit": 10,
  "results": [
    {
      "uuid": "c0e09d5a-8c3d-45bd-985c-dd44008ad503",
      "domain": "erutjhpk.login.dwmnhsqa.wccheck-6b3c4826-a.santandertelephony-yfcowbeta.bimp-bot.duckdns.org",
      "url": "https://erutjhpk.login.dwmnhsqa.wccheck-6b3c4826-a.santandertelephony-yfcowbeta.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-08 05:27:31.103158+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "51734",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "195.234.4.57",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
          "contributed": 11.2
        },
        {
          "type": "same_org",
          "value": "HOSTLAB LLC",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "bimp",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Gandi SAS",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "8f0f87e1033cf8f0~8f0f87e1033cf8f0 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/santander/c0e09d5a-8c3d-45bd-985c-dd44008ad503/",
      "service_range": null
    },
    {
      "uuid": "d371b197-ebdd-467d-8a2b-dcac979b46c2",
      "domain": "ewlpnkrg.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "url": "https://ewlpnkrg.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-05 05:27:31.736322+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "51734",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "195.234.4.57",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
          "contributed": 11.2
        },
        {
          "type": "same_org",
          "value": "HOSTLAB LLC",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "bimp",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Gandi SAS",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "8f0f87e1033cf8f0~8f0f87e1033cf8f0 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/santander/d371b197-ebdd-467d-8a2b-dcac979b46c2/",
      "service_range": null
    },
    {
      "uuid": "9c728943-8728-4102-a4ab-b806081e4bd4",
      "domain": "ewlpnkrg.www.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "url": "https://ewlpnkrg.www.login.wccheck-0209014e-ext.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-05 05:27:31.802821+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "51734",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "195.234.4.57",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
          "contributed": 11.2
        },
        {
          "type": "same_org",
          "value": "HOSTLAB LLC",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "bimp",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Gandi SAS",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "8f0f87e1033cf8f0~8f0f87e1033cf8f0 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/santander/9c728943-8728-4102-a4ab-b806081e4bd4/",
      "service_range": null
    },
    {
      "uuid": "9a303b31-c9bf-4144-bfa6-05113726db44",
      "domain": "lkgrazsl.login.5b55bakaizeipheexooz.bckwsbem.santander.bimp-bot.duckdns.org",
      "url": "https://lkgrazsl.login.5b55bakaizeipheexooz.bckwsbem.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-08 05:27:36.298004+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "51734",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "195.234.4.57",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
          "contributed": 11.2
        },
        {
          "type": "same_org",
          "value": "HOSTLAB LLC",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "bimp",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Gandi SAS",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "8f0f87e1033cf8f0~8f0f87e1033cf8f0 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/santander/9a303b31-c9bf-4144-bfa6-05113726db44/",
      "service_range": null
    },
    {
      "uuid": "4466ee66-95d8-4787-aa29-9987c06d1e34",
      "domain": "login.rmdbwskx.santander.bimp-bot.duckdns.org",
      "url": "https://login.rmdbwskx.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-07 17:27:20.384080+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "51734",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "195.234.4.57",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
          "contributed": 11.2
        },
        {
          "type": "same_org",
          "value": "HOSTLAB LLC",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "bimp",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Gandi SAS",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "8f0f87e1033cf8f0~8f0f87e1033cf8f0 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/santander/4466ee66-95d8-4787-aa29-9987c06d1e34/",
      "service_range": null
    },
    {
      "uuid": "eae29de0-315e-41e6-9cf7-46d7dcf32858",
      "domain": "login.wccheck-b18ca936-a.santander.bimp-bot.duckdns.org",
      "url": "https://login.wccheck-b18ca936-a.santander.bimp-bot.duckdns.org",
      "company": "santander",
      "status": "active",
      "first_seen": "2026-08-07 17:27:25.574629+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "51734",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "195.234.4.57",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
          "contributed": 11.2
        },
        {
          "type": "same_org",
          "value": "HOSTLAB LLC",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "bimp",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Gandi SAS",
          "contributed": 4
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "8f0f87e1033cf8f0~8f0f87e1033cf8f0 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/santander/eae29de0-315e-41e6-9cf7-46d7dcf32858/",
      "service_range": null
    },
    {
      "uuid": "f6a0e636-01a8-4a7a-a53d-23e72e3c4bea",
      "domain": "zxexxnym.bradesco.support.zaka25.duckdns.org",
      "url": "https://zxexxnym.bradesco.support.zaka25.duckdns.org",
      "company": "bradesco",
      "status": "active",
      "first_seen": "2026-10-19 23:22:58.732864+00:00",
      "relationship_score": 44,
      "evidence": [
        {
          "type": "same_ns_set",
          "value": "ns1.duckdns.org,ns2.duckdns.org,ns3.duckdns.org,ns4.duckdns.org,ns5.duckdns.org,ns6.duckdns.org,ns7.duckdns.org,ns8.duc\u2026",
          "contributed": 11.2
        },
        {
          "type": "shared_distinctive_token",
          "value": "duckdns",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Gandi SAS",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "18.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "san_overlap",
          "value": "duckdns.org",
          "contributed": 12.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/bradesco/f6a0e636-01a8-4a7a-a53d-23e72e3c4bea/",
      "service_range": {
        "best": {
          "direction": "both",
          "kind": "hosting",
          "kind_label": "rentable cloud hosting",
          "prefix": "147.224.128.0/18",
          "provider": "Oracle Cloud",
          "region": "us-chicago-1",
          "service": "OCI",
          "source": "oracle"
        },
        "also": [],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      }
    }
  ]
}