NSS glossary: threat intel terms in plain language

[ N S S | > topics ]

Glossary

The terms used in NSS research, in plain language. Each one links to the papers and topic pages where it appears.

Address block: A run of neighbouring IP addresses held by one network. NSS compares blocks to see whether names that point at different addresses were set up together.; Appears inNSS-OC-01 NSS-RH-01 Lookalike domains
ATT&CK technique: An entry in ATT&CK, the public knowledge base of attacker behaviour, such as T1036 Masquerading. A paper maps what NSS saw to these ids so a defender can match it to their own controls.; Appears inNSS-ZM-01 Fake software update lures
Attribution: Naming the group behind activity. No NSS paper is attributed to a named group. A match in method with public reporting is not a link to an actor.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 Fake software update lures How NSS confirms infrastructure
Capture: NSS loading a page as a phone, a desktop or a crawler and keeping what each answered: the screenshot, the page source and every forwarding step, including pages that did not load.; Appears inNSS-OC-01 NSS-RH-01 NSS-ZM-01 Lookalike domains How NSS confirms infrastructure
Casefile: The stored NSS record for one name or address: registration, name servers, addresses, forwarding, certificates, the page and the verdict, each with the time it was read.; Appears inNSS-WA-01 NSS-ZM-01 Fake software update lures
Certificate: The certificate a site presents to prove its name to a browser. It can follow a registration closely: in NSS-ZM-01 the lure's first certificate came 23 minutes after the name was registered.; Appears inNSS-OC-01 NSS-RH-01 NSS-ZM-01 Fake software update lures
Certificate transparency: Public logs in which newly issued certificates are recorded. A new entry shows that a name is about to serve pages, so NSS reads the logs to record names as they appear.; Appears inNSS-RH-01 NSS-ZM-01 Redirect and throwaway domains How NSS confirms infrastructure
Client id: The identifier a remote-access client carries for the server it belongs to. In NSS-ZM-01 it also names the installed service, which makes it a useful search on endpoints.; Appears inNSS-ZM-01 Remote-access tool abuse
Connect-back: The host and port an installed client calls on its own once it runs. In NSS-ZM-01 the installer is set to connect back to the sender's relay on port 8041.; Appears inNSS-ZM-01 Fake software update lures Remote-access tool abuse
Dedicated host: A server that serves one party's names only. Only a dedicated host's address is a fair block rule; papers say when a host first filed as dedicated turned out not to be.; Appears inNSS-OC-01 NSS-RH-01 Redirect and throwaway domains
Defanged: An indicator written so it cannot be opened by accident: each dot becomes [.] and a web scheme becomes hxxp. NSS writes every indicator on a page this way and never as a link.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 How NSS confirms infrastructure
Default certificate: A certificate shipped with a product and present on every installation of it. Two hosts that share one run the same software, not necessarily for the same party.; Appears inNSS-RH-01 Redirect and throwaway domains How NSS confirms infrastructure
Delivery network: A shared service that sits in front of many customers' sites and answers for them from a pool of addresses. Its addresses serve unrelated sites, so they are not indicators.; Appears inNSS-RH-01 NSS-ZM-01 Remote-access tool abuse Redirect and throwaway domains How NSS confirms infrastructure
Forwarding label: The name a forwarding or delivery service gives one customer set-up. Every name placed behind it points at the label, so a shared label ties names together.; Appears inNSS-WA-01 NSS-RH-01 Redirect and throwaway domains How NSS confirms infrastructure
Found by NSS: A paper label. Found by NSS: NSS recorded this in its own data; listing state checked on the publication day. Expanded by NSS: NSS recorded these names itself; the pattern, or some of the names, was already on public lists. NSS original analysis: names came from public lists; the grouping, captures and checks are NSS's own work.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 How NSS confirms infrastructure
Host type: What kind of host an address is: dedicated, shared, a hosting platform or a delivery network. NSS reads the host type before it treats an address as a verdict.; Appears inNSS-OC-01 NSS-RH-01 Redirect and throwaway domains
Indicator (IOC): An indicator of compromise: a domain name, address, link, file hash or mail address tied to hostile activity. Each paper lists its indicators in CSV and JSON files.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 Lookalike domains
Kit: A set of names set up and run together, joined on shared records. In NSS-WA-01, Investigate reported 51 lookalike names as one kit.; Appears inNSS-WA-01 Lookalike domains
Landing name: The name a chain of redirects ends on: the page the visitor finally sees after each forwarding step.; Appears inNSS-RH-01 Redirect and throwaway domains
Lookalike: A domain name made to be read as another brand's, for example by swapping a letter or adding a prefix. A lookalike pattern is a reason to look, not proof on its own.; Appears inNSS-WA-01 NSS-ZM-01 Lookalike domains
Lure: The page or message that gets a visitor to act, such as a fake update prompt. In NSS-ZM-01 the operator's domains were bought weeks before the lure.; Appears inNSS-ZM-01 Fake software update lures
Name servers: The servers that answer for a domain's records. Registrars give every customer a default pair, so a shared default is not a link between names.; Appears inNSS-WA-01 NSS-OC-01 Lookalike domains How NSS confirms infrastructure
Newly registered names: The daily lists of domain names registered the day before. NSS reads them to record new names as they appear.; Appears inNSS-WA-01 NSS-RH-01 NSS-ZM-01 Fake software update lures Redirect and throwaway domains
On no list NSS holds: Checked against every list NSS takes in, on the stated day. It does not mean on no list anywhere.; Appears inNSS-RH-01 NSS-ZM-01 Fake software update lures Redirect and throwaway domains How NSS confirms infrastructure
Operator: Whoever sets up and runs a group of names and hosts. NSS names an operator only when shared records support it, never from a shared default.; Appears inNSS-OC-01 NSS-RH-01 NSS-ZM-01 How NSS confirms infrastructure
Origin certificate: A certificate a delivery network issues for the server that sits behind it. In NSS-ZM-01 the server's origin certificate dates from the day the portal's domain got its first certificate.; Appears inNSS-ZM-01 Remote-access tool abuse
Public warning list: A published list of names or addresses judged harmful. A list says a name is bad; it does not say which names belong together.; Appears inNSS-OC-01 NSS-RH-01 Lookalike domains How NSS confirms infrastructure
Registered domain: The part of a name that is bought from a registrar. Its owner can add any number of names under it, so 319 names can sit under 191 registered domains.; Appears inNSS-RH-01 NSS-ZM-01 Redirect and throwaway domains
Registrar: The company that sells a domain name and files its registration record. A registrar named in a paper is named because the public record names it.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 Lookalike domains
Registration batch: Names bought together in one order. NSS counts five or more names from one registrar, each within 30 seconds of the one before, as one batch.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 Lookalike domains Redirect and throwaway domains How NSS confirms infrastructure
Registration record: The public record of a domain: when it was registered, to the second, the registrar, the name servers and the status.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 Lookalike domains How NSS confirms infrastructure
Registry hold: A status that stops a name from resolving, often set after abuse reports. In NSS-WA-01 at least 19 names were put on hold.; Appears inNSS-WA-01 NSS-OC-01 Lookalike domains
Relay: A service that passes traffic on. In NSS-WA-01 names forwarded through a relay service with other customers, so its own domain is not an indicator. In NSS-ZM-01 the relay is the remote-access server port the client calls.; Appears inNSS-WA-01 NSS-ZM-01 Lookalike domains Remote-access tool abuse How NSS confirms infrastructure
Remote-access client: Software that lets someone control a computer from elsewhere. Helpdesks use it legitimately. Set to call a stranger's server, it hands that stranger control.; Appears inNSS-ZM-01 Fake software update lures
Resolves: A name resolves when a lookup returns an address for it. A resolution check records where every name in a set points at a stated time.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 How NSS confirms infrastructure
Self-hosted instance: A copy of a product run on the user's own server rather than the vendor's service. In NSS-ZM-01 the sender ran their own remote-support portal.; Appears inNSS-ZM-01 Remote-access tool abuse
Throwaway name: A domain name bought cheaply, often in bulk, to be used briefly and dropped. Throwaway names often carry random letters or numbers.; Appears inNSS-RH-01 Redirect and throwaway domains
TLP:CLEAR: A Traffic Light Protocol marking: the material may be shared without restriction. Every published NSS paper carries it.; Appears inNSS-WA-01 NSS-OC-01 NSS-RH-01 NSS-ZM-01 How NSS confirms infrastructure