DNS/HTTP Access to Toll/Postal-Themed Smishing Domains (JWR Kit)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•2

Detects network requests (DNS queries or HTTP requests) to a predefined list of lookalike domains associated with the JWR phishing kit. These domains are designed to impersonate legitimate transport (LTA, OneMotoring, ERP) or courier/postal brands (Ninja Van, SingPost, Emirates Post) to deliver malicious payloads or credential harvesting pages.