JWR phishing client engine main.js retrieval over HTTP

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

This rule detects an HTTP GET request for 'static/js/main.js', a specific URI path associated with the JWR phishing framework's client-side engine. This indicates an interaction with a phishing infrastructure hosting malicious redirection or credential harvesting scripts.