Last seven days
- First activity
- Aug 24, 2026
- Last activity
- Aug 24, 2026
- Feed role
- Distribution
- Host form
- 0 IP / 606 hostnames
Observed infrastructure
Leading locations
- US218
Leading providers
- Alibaba (US) Technology Co., Ltd.129
- Cloudflare, Inc.89
Infrastructure traits
- Hosting 218
- Anycast 89
- Proxy 3
Reported operators
Threat actors
1 named in public reportingJWR is a phishing framework built for live fraud. It turns a fake payment or bank page into a live channel that lets criminals watch details arrive as they are typed.
MITRE ATT&CK
JWR in ATT&CK
17 distinct techniquesTechniques
17 techniques T1056 Input Capture T1041 Exfiltration Over C2 Channel T1573 Encrypted Channel T1071 Application Layer Protocol T1036 Masquerading T1566 Phishing T1027 Obfuscated Files or Information T1071.001 Web Protocols T1497.001 System Checks T1566.003 Spearphishing via Service T1592 Gather Victim Host Information T1539 Steal Web Session Cookie T1059.007 JavaScript T1614 System Location Discovery T1008 Fallback Channels T1622 Debugger Evasion T1082 System Information Discovery
