{
  "uuid": "a37b86f1-1a81-444f-93b0-2b7e16fd36c9",
  "domain": "zh.wave-whatsapp.com",
  "algorithm_version": "corr-1.4.0",
  "generated_at": "2026-11-09T05:00:37.190288+00:00",
  "cluster": null,
  "count": 3,
  "limit": 10,
  "results": [
    {
      "uuid": "d49045b7-5096-4271-8816-2124605617e5",
      "domain": "app.wave-whatsapp.com",
      "url": "https://app.wave-whatsapp.com",
      "company": "whatsapp",
      "status": "active",
      "first_seen": "2026-09-16 01:03:36.021520+00:00",
      "relationship_score": 62,
      "evidence": [
        {
          "type": "apex_subdomain_overlap",
          "value": "wave-whatsapp.com",
          "contributed": 9.7
        },
        {
          "type": "same_ns_set",
          "value": "dana.ns.cloudflare.com,pedro.ns.cloudflare.com",
          "contributed": 10.9
        },
        {
          "type": "shared_final_host",
          "value": "yandex.com",
          "contributed": 9.4
        },
        {
          "type": "shared_distinctive_token",
          "value": "wave",
          "contributed": 10.0
        },
        {
          "type": "same_registrar",
          "value": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.",
          "contributed": 4
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "72e7103660289566b0357b6ae69664f4cfc502ea19a4c3a052054cb232f63fb6",
          "contributed": 18.0
        },
        {
          "type": "san_overlap",
          "value": "wave-whatsapp.com",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/whatsapp/d49045b7-5096-4271-8816-2124605617e5/",
      "service_range": {
        "best": {
          "direction": "both",
          "kind": "platform",
          "kind_label": "shared platform that serves customer content",
          "prefix": "188.114.96.0/20",
          "provider": "Cloudflare",
          "region": "",
          "service": "CDN",
          "source": "cloudflare"
        },
        "also": [],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      },
      "url_only": false
    },
    {
      "uuid": "e3138aba-4b6b-45d6-94ce-a9b454c45f07",
      "domain": "secure.orbit-whatsapp.com",
      "url": "http://secure.orbit-whatsapp.com",
      "company": "whatsapp",
      "status": "active",
      "first_seen": "2026-09-09 01:01:41.160205+00:00",
      "relationship_score": 39,
      "evidence": [
        {
          "type": "same_ns_set",
          "value": "dana.ns.cloudflare.com,pedro.ns.cloudflare.com",
          "contributed": 11.2
        },
        {
          "type": "shared_final_host",
          "value": "yandex.com",
          "contributed": 9.6
        },
        {
          "type": "domain_age_window",
          "value": "4d/5d",
          "contributed": 5
        },
        {
          "type": "same_registrar",
          "value": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "4d/4d",
          "contributed": 3
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/whatsapp/e3138aba-4b6b-45d6-94ce-a9b454c45f07/",
      "service_range": {
        "best": {
          "direction": "both",
          "kind": "platform",
          "kind_label": "shared platform that serves customer content",
          "prefix": "188.114.96.0/20",
          "provider": "Cloudflare",
          "region": "",
          "service": "CDN",
          "source": "cloudflare"
        },
        "also": [],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      },
      "url_only": false
    },
    {
      "uuid": "94494d95-af3b-418d-bcfd-f73165cf1b55",
      "domain": "try.sigma-whatsapp.com",
      "url": "http://try.sigma-whatsapp.com",
      "company": "whatsapp",
      "status": "active",
      "first_seen": "2026-09-09 01:01:35.560310+00:00",
      "relationship_score": 39,
      "evidence": [
        {
          "type": "same_ns_set",
          "value": "dana.ns.cloudflare.com,pedro.ns.cloudflare.com",
          "contributed": 11.2
        },
        {
          "type": "shared_final_host",
          "value": "yandex.com",
          "contributed": 9.6
        },
        {
          "type": "domain_age_window",
          "value": "4d/5d",
          "contributed": 5
        },
        {
          "type": "same_registrar",
          "value": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "4d/4d",
          "contributed": 3
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/whatsapp/94494d95-af3b-418d-bcfd-f73165cf1b55/",
      "service_range": {
        "best": {
          "direction": "both",
          "kind": "platform",
          "kind_label": "shared platform that serves customer content",
          "prefix": "172.64.0.0/13",
          "provider": "Cloudflare",
          "region": "",
          "service": "CDN",
          "source": "cloudflare"
        },
        "also": [],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      },
      "url_only": false
    }
  ]
}