{
 "metadata": {
  "name": "NSS Daily Ledger",
  "site": "nsshq.com",
  "edition": "daily edition",
  "disclaimer": "Not enriched or vetted by NSS. Filtered to indicators reported in a malicious role in public security reporting, with a known-good list removed. No further vetting. Check before blocking.",
  "basis": "Drawn from public security reporting as published. Not individually verified. May include false positives.",
  "terms": "free to use and redistribute with attribution to NSS Daily Ledger (nsshq.com)",
  "corrections": "corrections@nsshq.com",
  "window_start": "2026-11-14T00:00:00Z",
  "window_end": "2026-11-15T00:00:00Z",
  "window_days": 1,
  "generated_at": "2026-11-15T00:20:01Z",
  "count": 27,
  "count_by_type": {
   "domain": 8,
   "md5": 6,
   "sha256": 7,
   "url": 6
  },
  "selection": "Every indicator that a public security report processed by NSS in the window presents as hostile, one row per indicator. No verdict is given.",
  "fields": [
   "type",
   "value",
   "first_seen",
   "source_count",
   "reference"
  ]
 },
 "rows": [
  {
   "type": "domain",
   "value": "anadnet.com",
   "first_seen": "2026-11-14T07:00:48Z",
   "source_count": 3,
   "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel"
  },
  {
   "type": "domain",
   "value": "backdoorphp8.1.0-dev.py",
   "first_seen": "2026-11-14T09:41:24Z",
   "source_count": 1,
   "reference": "php-8.1.0-dev-backdoor-rce"
  },
  {
   "type": "domain",
   "value": "mykolapalinchak.medianewsonline.com",
   "first_seen": "2026-10-13T13:53:57Z",
   "source_count": 1,
   "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure"
  },
  {
   "type": "domain",
   "value": "pokijhgcfsdfghnj.mywebcommunity.org",
   "first_seen": "2025-05-13T16:27:43Z",
   "source_count": 1,
   "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure"
  },
  {
   "type": "domain",
   "value": "qweasdzxc.mygamesonline.org",
   "first_seen": "2026-10-13T13:53:57Z",
   "source_count": 1,
   "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure"
  },
  {
   "type": "domain",
   "value": "w.anadnet.com",
   "first_seen": "2026-11-14T07:00:48Z",
   "source_count": 3,
   "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel"
  },
  {
   "type": "domain",
   "value": "wersdfxcv.mygamesonline.org",
   "first_seen": "2026-10-13T13:53:57Z",
   "source_count": 1,
   "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure"
  },
  {
   "type": "domain",
   "value": "www.cryptic-heaven.net",
   "first_seen": "2026-11-14T09:29:27Z",
   "source_count": 1,
   "reference": "How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP"
  },
  {
   "type": "md5",
   "value": "098f6bcd4621d373cade4e832627b4f6",
   "first_seen": "2026-10-20T22:07:11Z",
   "source_count": 1,
   "reference": "HTB: Nimbus"
  },
  {
   "type": "md5",
   "value": "36b3ecad8e2d570b8c53ed65e53842b3",
   "first_seen": "2026-11-14T17:09:04Z",
   "source_count": 1,
   "reference": "HTB: Nimbus"
  },
  {
   "type": "md5",
   "value": "3f49a821c5c08c9e5ef49f4084ecd513",
   "first_seen": "2026-11-14T17:09:04Z",
   "source_count": 1,
   "reference": "HTB: Nimbus"
  },
  {
   "type": "md5",
   "value": "648894d150483a6a8d1b9d555ff3a6f9",
   "first_seen": "2026-11-14T17:09:04Z",
   "source_count": 1,
   "reference": "HTB: Nimbus"
  },
  {
   "type": "md5",
   "value": "6e33ec0fe4463a313585d4c7f1e9097c",
   "first_seen": "2026-11-14T17:09:04Z",
   "source_count": 1,
   "reference": "HTB: Nimbus"
  },
  {
   "type": "md5",
   "value": "c236f2af130f959a5723562fa5eff7b2",
   "first_seen": "2026-11-14T17:09:04Z",
   "source_count": 1,
   "reference": "HTB: Nimbus"
  },
  {
   "type": "sha256",
   "value": "0f8978dc13690cab2fe33ad377e4c09bb1fa181ecd2fbba9fc1b2e7c17f8d70f",
   "first_seen": "2026-11-14T19:31:39Z",
   "source_count": 1,
   "reference": "MAL-2026-19937 Malicious code in gateio-ws (PyPI)"
  },
  {
   "type": "sha256",
   "value": "119ef283a7038fe02a4d309ce942bcce3a37a70ef5468749ae4f4e378d971e9d",
   "first_seen": "2026-11-14T17:05:48Z",
   "source_count": 1,
   "reference": "MAL-2026-19934 Malicious code in ps-bool (PyPI)"
  },
  {
   "type": "sha256",
   "value": "1bece13e2be06ddffd2ed4bf25cc171363f7e3030003e5eda4e49ede0988b115",
   "first_seen": "2026-11-14T17:05:48Z",
   "source_count": 1,
   "reference": "MAL-2026-19933 Malicious code in gateio-client (PyPI)"
  },
  {
   "type": "sha256",
   "value": "a1146a6fabdfef289472f99a56851249e7a46e8d19d4d8bf85fe833e2f0158b6",
   "first_seen": "2026-11-14T02:14:52Z",
   "source_count": 1,
   "reference": "GHSA-QFX6-Q44V-9QQW ag-psd can exhaust memory when parsing crafted PSD dimensions"
  },
  {
   "type": "sha256",
   "value": "d2ce56d3cbce6034dcebd88520ffec19a094c0888b7e797f66c46bc69e8d2eac",
   "first_seen": "2026-11-14T19:31:39Z",
   "source_count": 1,
   "reference": "MAL-2026-19935 Malicious code in demo-pingtest-xyz (PyPI)"
  },
  {
   "type": "sha256",
   "value": "da5f11fa30f28362c8394977403d7736c91c828ba295b3d175baa1c8539edf8b",
   "first_seen": "2026-11-14T09:37:38Z",
   "source_count": 1,
   "reference": "MAL-2026-19930 Malicious code in trezortranslate (PyPI)"
  },
  {
   "type": "sha256",
   "value": "daf0fb9836af133a053a98dbd88106efeaccd310d038b52f596a53be0efc6f76",
   "first_seen": "2026-11-14T19:31:39Z",
   "source_count": 1,
   "reference": "MAL-2026-19936 Malicious code in gateio-sdk (PyPI)"
  },
  {
   "type": "url",
   "value": "http://aws.nimbus.htb/847219365028/nimbus-jobs",
   "first_seen": "2026-11-14T17:09:04Z",
   "source_count": 1,
   "reference": "HTB: Nimbus"
  },
  {
   "type": "url",
   "value": "https://anadnet.com/updates/?action=getmetadata&slug=quick-pagepost-redirect-quick",
   "first_seen": "2026-11-14T07:01:26Z",
   "source_count": 3,
   "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel"
  },
  {
   "type": "url",
   "value": "https://w.anadnet.com/bro/3/",
   "first_seen": "2026-11-14T07:00:48Z",
   "source_count": 3,
   "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel"
  },
  {
   "type": "url",
   "value": "https://webhook.site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-cmdi",
   "first_seen": "2026-11-14T09:37:38Z",
   "source_count": 1,
   "reference": "mechanize-takehome-rce-poc"
  },
  {
   "type": "url",
   "value": "https://webhook.site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-ssti",
   "first_seen": "2026-11-14T09:37:38Z",
   "source_count": 1,
   "reference": "mechanize-takehome-rce-poc"
  },
  {
   "type": "url",
   "value": "https://www.cryptic-heaven.net/contract",
   "first_seen": "2026-11-14T09:29:27Z",
   "source_count": 1,
   "reference": "How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP"
  }
 ]
}