DOUBLECUP — CRM-brand phishing lures (SMQL tracker)

Split from the original single-anchor draft: the combined 29-term query exceeded the SMQL engine cap of 20 filter nodes (validator.MAX_FILTER_NODES), so the cron logged 'invalid SMQL, skipping' every 15 min and the anchor was inert. Same hunt_family, one row per indicator class, each under the cap. The ip: terms are the durable half — they match resolved IPs, so a new domain on the same host still trips. See hunt 169 for the YARA anchor.