{
  "uuid": "bbda60f7-df45-419a-a34c-4886b61df344",
  "domain": "apps.microsofth.com",
  "algorithm_version": "corr-1.4.0",
  "generated_at": "2026-11-04T05:00:40.211180+00:00",
  "cluster": null,
  "count": 9,
  "limit": 10,
  "results": [
    {
      "uuid": "e60291be-e4ef-4e27-81e1-3dbdab5240ad",
      "domain": "auth.microsofth.com",
      "url": "https://auth.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:54.672338+00:00",
      "relationship_score": 76,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "b171717171717171~b171717171717171 d=0",
          "contributed": 16.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/e60291be-e4ef-4e27-81e1-3dbdab5240ad/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "20b19489-5cd1-4a42-a811-f51890703c6d",
      "domain": "azure.microsofth.com",
      "url": "https://azure.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:54.860351+00:00",
      "relationship_score": 76,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "b171717171717171~b171717171717171 d=0",
          "contributed": 16.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/20b19489-5cd1-4a42-a811-f51890703c6d/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "78d11b78-43aa-4c06-b000-62eb13006e37",
      "domain": "cloud.microsofth.com",
      "url": "https://cloud.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:55.124312+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/78d11b78-43aa-4c06-b000-62eb13006e37/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "3fa4b607-d723-4317-b8f5-d527cf9f863c",
      "domain": "com.microsofth.com",
      "url": "https://com.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:55.266515+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/3fa4b607-d723-4317-b8f5-d527cf9f863c/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "ed273d3f-56ba-4a81-9d82-b14ceed80a2b",
      "domain": "data.microsofth.com",
      "url": "https://data.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:55.467926+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/ed273d3f-56ba-4a81-9d82-b14ceed80a2b/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "9a642c8b-73d2-496e-a5df-f98c560a5cc6",
      "domain": "dotnet.microsofth.com",
      "url": "https://dotnet.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:55.561613+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/9a642c8b-73d2-496e-a5df-f98c560a5cc6/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "5f488a79-df9b-4607-97e9-169b40d6f3f2",
      "domain": "edge.microsofth.com",
      "url": "https://edge.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:55.651515+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/5f488a79-df9b-4607-97e9-169b40d6f3f2/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "efc62671-ff3a-41df-9005-601520cc55bb",
      "domain": "flow.microsofth.com",
      "url": "https://flow.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:55.728729+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/efc62671-ff3a-41df-9005-601520cc55bb/",
      "service_range": null,
      "url_only": false
    },
    {
      "uuid": "c54d44c1-35f6-4d9b-a81d-e137e7a97a07",
      "domain": "help.microsofth.com",
      "url": "https://help.microsofth.com",
      "company": "microsoft",
      "status": "active",
      "first_seen": "2026-10-31 17:22:55.814461+00:00",
      "relationship_score": 60,
      "evidence": [
        {
          "type": "same_asn",
          "value": "133618",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "103.224.182.246",
          "contributed": 17.6
        },
        {
          "type": "same_ns_set",
          "value": "ns1.abovedomains.com,ns2.abovedomains.com",
          "contributed": 7.0
        },
        {
          "type": "same_org",
          "value": "Trellian Pty. Limited",
          "contributed": 0.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "microsofth",
          "contributed": 8.0
        },
        {
          "type": "same_registrar",
          "value": "Dynadot Inc",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "cert_age_window",
          "value": "0d/0d",
          "contributed": 3
        },
        {
          "type": "cert_fingerprint_exact",
          "value": "45a2e97ba522e210673fa214be255b2a2443d7990ec3270c905bca91d6642b3a",
          "contributed": 14.4
        },
        {
          "type": "san_overlap",
          "value": "agentotoplay-web.xyz",
          "contributed": 0.0
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/microsoft/c54d44c1-35f6-4d9b-a81d-e137e7a97a07/",
      "service_range": null,
      "url_only": false
    }
  ]
}