JWR-style brand-impersonation domain cluster (multi-hostname correlation)
Correlates DNS/network requests to newly observed domains matching JWR's brand-plus-suffix generation pattern across .top/.cfd/.info/.cc TLDs, requiring multiple distinct hostnames sharing the same brand token within a short window to flag likely batch-registered phishing infrastructure.
Microsoft Sentinel (KQL)
