# NSS Daily Ledger

**Disclaimer: Not enriched or vetted by NSS. Filtered to indicators reported in a malicious role in public security reporting, with a known-good list removed. No further vetting. Check before blocking.**

NSS Daily Ledger (nsshq.com): indicators from public security reporting, daily edition.

- Drawn from public security reporting as published. Not individually verified. May include false positives.
- Terms: free to use and redistribute with attribution to NSS Daily Ledger (nsshq.com). Corrections: corrections@nsshq.com
- Window: 2026-11-14T00:00:00Z to 2026-11-15T00:00:00Z (UTC, the end is not included)
- Generated: 2026-11-15T00:20:01Z
- Indicators: 27
- Selection: Every indicator that a public security report processed by NSS in the window presents as hostile, one row per indicator. No verdict is given.
- Fields: type, value, first_seen (UTC, the earliest time NSS recorded the indicator), source_count (distinct public reports in the window that carry it), reference (the headline of one of those reports, or 'headline not shown').

Indicators are written defanged here (dots in brackets, the scheme broken). The plain text, CSV and JSON editions carry the same rows in machine form.

## Domains (8)

### anadnet[.]com

First recorded by NSS on 2026-11-14 at 07:00 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel.

### backdoorphp8[.]1[.]0-dev[.]py

First recorded by NSS on 2026-11-14 at 09:41 UTC. Public reports in the window: 1. Reference: php-8.1.0-dev-backdoor-rce.

### mykolapalinchak[.]medianewsonline[.]com

First recorded by NSS on 2026-10-13 at 13:53 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure.

### pokijhgcfsdfghnj[.]mywebcommunity[.]org

First recorded by NSS on 2025-05-13 at 16:27 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure.

### qweasdzxc[.]mygamesonline[.]org

First recorded by NSS on 2026-10-13 at 13:53 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure.

### w[.]anadnet[.]com

First recorded by NSS on 2026-11-14 at 07:00 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel.

### wersdfxcv[.]mygamesonline[.]org

First recorded by NSS on 2026-10-13 at 13:53 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure.

### www[.]cryptic-heaven[.]net

First recorded by NSS on 2026-11-14 at 09:29 UTC. Public reports in the window: 1. Reference: How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP.

## MD5 hashes (6)

### 098f6bcd4621d373cade4e832627b4f6

First recorded by NSS on 2026-10-20 at 22:07 UTC. Public reports in the window: 1. Reference: HTB: Nimbus.

### 36b3ecad8e2d570b8c53ed65e53842b3

First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus.

### 3f49a821c5c08c9e5ef49f4084ecd513

First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus.

### 648894d150483a6a8d1b9d555ff3a6f9

First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus.

### 6e33ec0fe4463a313585d4c7f1e9097c

First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus.

### c236f2af130f959a5723562fa5eff7b2

First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus.

## SHA-256 hashes (7)

### 0f8978dc13690cab2fe33ad377e4c09bb1fa181ecd2fbba9fc1b2e7c17f8d70f

First recorded by NSS on 2026-11-14 at 19:31 UTC. Public reports in the window: 1. Reference: MAL-2026-19937 Malicious code in gateio-ws (PyPI).

### 119ef283a7038fe02a4d309ce942bcce3a37a70ef5468749ae4f4e378d971e9d

First recorded by NSS on 2026-11-14 at 17:05 UTC. Public reports in the window: 1. Reference: MAL-2026-19934 Malicious code in ps-bool (PyPI).

### 1bece13e2be06ddffd2ed4bf25cc171363f7e3030003e5eda4e49ede0988b115

First recorded by NSS on 2026-11-14 at 17:05 UTC. Public reports in the window: 1. Reference: MAL-2026-19933 Malicious code in gateio-client (PyPI).

### a1146a6fabdfef289472f99a56851249e7a46e8d19d4d8bf85fe833e2f0158b6

First recorded by NSS on 2026-11-14 at 02:14 UTC. Public reports in the window: 1. Reference: GHSA-QFX6-Q44V-9QQW ag-psd can exhaust memory when parsing crafted PSD dimensions.

### d2ce56d3cbce6034dcebd88520ffec19a094c0888b7e797f66c46bc69e8d2eac

First recorded by NSS on 2026-11-14 at 19:31 UTC. Public reports in the window: 1. Reference: MAL-2026-19935 Malicious code in demo-pingtest-xyz (PyPI).

### da5f11fa30f28362c8394977403d7736c91c828ba295b3d175baa1c8539edf8b

First recorded by NSS on 2026-11-14 at 09:37 UTC. Public reports in the window: 1. Reference: MAL-2026-19930 Malicious code in trezortranslate (PyPI).

### daf0fb9836af133a053a98dbd88106efeaccd310d038b52f596a53be0efc6f76

First recorded by NSS on 2026-11-14 at 19:31 UTC. Public reports in the window: 1. Reference: MAL-2026-19936 Malicious code in gateio-sdk (PyPI).

## URLs (6)

### hxxp://aws[.]nimbus[.]htb/847219365028/nimbus-jobs

First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus.

### hxxps://anadnet[.]com/updates/?action=getmetadata&slug=quick-pagepost-redirect-quick

First recorded by NSS on 2026-11-14 at 07:01 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel.

### hxxps://w[.]anadnet[.]com/bro/3/

First recorded by NSS on 2026-11-14 at 07:00 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel.

### hxxps://webhook[.]site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-cmdi

First recorded by NSS on 2026-11-14 at 09:37 UTC. Public reports in the window: 1. Reference: mechanize-takehome-rce-poc.

### hxxps://webhook[.]site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-ssti

First recorded by NSS on 2026-11-14 at 09:37 UTC. Public reports in the window: 1. Reference: mechanize-takehome-rce-poc.

### hxxps://www[.]cryptic-heaven[.]net/contract

First recorded by NSS on 2026-11-14 at 09:29 UTC. Public reports in the window: 1. Reference: How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP.