JWR phishing domain/IP IOC match (network/DNS)
Detects DNS resolution, network connections, or email-embedded URLs matching known JWR phishing framework hosting domains and IP addresses, including banking/government/logistics brand-impersonation lookalikes and smishing-delivered typosquats.
Microsoft Sentinel (KQL)
