Eight battle-tested queries that caught real campaigns in 2025 (ClickFix, Latrodectus, Lumma, SmartApeSG, Fake Google Play, etc.). Copy → paste → detect.
#1 ClickFix – Reservation-ID Phishing Domains
Catches reservation-id8159.com-style malvertising domains.
#2 PoisonSeed – SendGrid MFA Phishing
NICENIC + hyphenated + “sendgrid” = instant credential-phishing cluster.