{
 "paper": "NSS-TL-01",
 "title": "One wallet-phishing operator, six servers in three weeks: followed by the names it carried host to host",
 "tlp": "CLEAR",
 "publisher": "Nexus Sentinel Station (NSS)",
 "url": "https://nsshq.com/research/wallet-phishing-host-lineage",
 "published": "2026-11-14",
 "note": "Indicators are written in full, not defanged: handle with care. layer says what each row is in the paper (host, forwarding, moved-name, name, download, earlier-host). list_date is the date the threat list NSS takes in gives for the indicator, checked on 14 Nov 2026 (empty: on no such list). host_type is NSS's host class: for an address its own class, for a name the class of the address it resolved to at the read (n/a: no address at the read; no current record: NSS holds no current host type for the address).",
 "count": 116,
 "indicators": [
  {
   "type": "ipv4",
   "value": "94.26.106.72",
   "note": "Host 1 of the chain: 13 names of the operator seen on it 27 Oct 2026 to 31 Oct 2026, 13 of them on a threat list NSS takes in on 14 Nov 2026; no name of the operation on it after 31 Oct 2026",
   "layer": "host",
   "nss_first_record_utc": "2026-10-27",
   "list_date": "2026-07-06",
   "nss_verdict_14_nov_2026": "Suspicious",
   "host_type": "no current record"
  },
  {
   "type": "ipv4",
   "value": "103.38.82.152",
   "note": "Host 2 of the chain: 6 names of the operator seen on it 1 Nov 2026 to 6 Nov 2026, 6 of them on a threat list NSS takes in on 14 Nov 2026; no name of the operation on it after 6 Nov 2026",
   "layer": "host",
   "nss_first_record_utc": "2026-11-01",
   "list_date": "",
   "nss_verdict_14_nov_2026": "Suspicious",
   "host_type": "no current record"
  },
  {
   "type": "ipv4",
   "value": "103.38.82.202",
   "note": "Host 3 of the chain: 26 names of the operator seen on it 3 Nov 2026 to 10 Nov 2026, 17 of them on a threat list NSS takes in on 14 Nov 2026; classed a dedicated host by NSS",
   "layer": "host",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "ipv4",
   "value": "156.225.24.233",
   "note": "Host 4 of the chain: 14 names of the operator seen on it 3 Nov 2026 to 10 Nov 2026, 9 of them on a threat list NSS takes in on 14 Nov 2026; classed a dedicated host by NSS",
   "layer": "host",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "ipv4",
   "value": "156.225.24.119",
   "note": "Host 5 of the chain: 23 names of the operator seen on it 3 Nov 2026 to 9 Nov 2026, 10 of them on a threat list NSS takes in on 14 Nov 2026; classed a dedicated host by NSS",
   "layer": "host",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "ipv4",
   "value": "82.158.231.42",
   "note": "Host 6 of the chain: 55 names of the operator seen on it 11 Nov 2026 to 14 Nov 2026, 7 of them on a threat list NSS takes in on 14 Nov 2026; classed a dedicated host by NSS",
   "layer": "host",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "atzuqs2x.yumsihjkk.cc",
   "note": "The constant forwarding label: the three telergam-cdn names point at it; the same label sat under ikunzf.online from 31 Oct to 6 Nov 2026 and under this apex from 12 Nov 2026; on no threat list NSS takes in",
   "layer": "forwarding",
   "nss_first_record_utc": "",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "yumsihjkk.cc",
   "note": "Forwarding apex of the operator, registered 11 Nov 2026 04:47 UTC; 33 names forwarded through labels under it in NSS's record; on no threat list NSS takes in",
   "layer": "forwarding",
   "nss_first_record_utc": "",
   "list_date": "",
   "nss_verdict_14_nov_2026": "Suspicious",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "z6pnwmjk.yumsihjkk.cc",
   "note": "The shared host label under the apex: on 14 Nov 2026 a forwarded name resolved through its own label to this one, which gave the current server, 82.158.231.42; on no threat list NSS takes in",
   "layer": "forwarding",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "im-token-xjp-cdn.wiki",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 5 (7 Nov 2026); forwarded through label xwsjqutn under ikunzf.online; on a threat list NSS takes in, list date 28 Sep 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-09-28",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "mtoken-im.cv",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 5 (6 Nov 2026), then host 6 (12 Nov 2026); forwarded through label zwc9j6s4 under ikunzf.online; on a threat list NSS takes in, list date 2 Aug 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-08-02",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "mtoken.download",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 5 (7 Nov 2026); on a threat list NSS takes in, list date 14 Sep 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-09-14",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "mtoken.online",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 3 (7 Nov 2026); on a threat list NSS takes in, list date 14 Sep 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-09-14",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "telegam-zh-cn.com",
   "note": "Moved host to host: host 2 (1 Nov 2026), then host 4 (7 Nov 2026); forwarded through label 6xd8fw3p under ikunzf.online; on a threat list NSS takes in, list date 4 Aug 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-01",
   "list_date": "2026-08-04",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "telegramorg-cn.co",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 3 (6 Nov 2026), then host 6 (12 Nov 2026); forwarded through label uzvn8r64 under ikunzf.online; on a threat list NSS takes in, list date 4 Aug 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-08-04",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "telegramorg-cn.com",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 5 (6 Nov 2026), then host 6 (12 Nov 2026); forwarded through label q54ae7mj under ikunzf.online; on a threat list NSS takes in, list date 4 Aug 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-08-04",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "telergam-cdn71386.aa9977rt.com",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 3 (6 Nov 2026), then host 6 (12 Nov 2026); forwarded through label atzuqs2x under ikunzf.online, then yumsihjkk.cc; on a threat list NSS takes in, list date 4 Aug 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-08-04",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "telergam-cdn83124.aa9977rt.com",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 2 (6 Nov 2026), then host 6 (12 Nov 2026); forwarded through label atzuqs2x under ikunzf.online, then yumsihjkk.cc; on a threat list NSS takes in, list date 4 Aug 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-08-04",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "telergam-cdn99471.aa9977rt.com",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 4 (6 Nov 2026), then host 6 (12 Nov 2026); forwarded through label atzuqs2x under ikunzf.online, then yumsihjkk.cc; on a threat list NSS takes in, list date 4 Aug 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-08-04",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "timerime-cdn3-hk62.xyz",
   "note": "Moved host to host: host 4 (10 Nov 2026), then host 6 (12 Nov 2026); forwarded through label 59e8ragw under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "timerime-cdn3-hk73.quest",
   "note": "Moved host to host: host 3 (7 Nov 2026), then host 5 (8 Nov 2026); forwarded through label e4bqfth8 under ikunzf.online; on a threat list NSS takes in, list date 8 Nov 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "2026-11-08",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokafimer-cdn6-hk33.homes",
   "note": "Moved host to host: host 5 (9 Nov 2026), then host 6 (12 Nov 2026); forwarded through label bmrq8n59 under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokaixemcdn8-hk22.cfd",
   "note": "Moved host to host: host 3 (10 Nov 2026), then host 6 (12 Nov 2026); forwarded through label cgz593am under ikunzf.online; on a threat list NSS takes in, list date 11 Nov 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "2026-11-11",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokanim-cdn13-hk13.club",
   "note": "Moved host to host: host 5 (3 Nov 2026), then host 3 (3 Nov 2026), then host 4 (8 Nov 2026); forwarded through label 45gnmx6k under ikunzf.online; on a threat list NSS takes in, list date 18 Oct 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "2026-10-18",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokanim-cdn19-hk19.club",
   "note": "Moved host to host: host 2 (3 Nov 2026), then host 4 (3 Nov 2026), then host 5 (8 Nov 2026); forwarded through label pz43re72 under ikunzf.online; on a threat list NSS takes in, list date 18 Oct 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "2026-10-18",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemiem-cdn35-hk61.click",
   "note": "Moved host to host: host 3 (7 Nov 2026), then host 6 (12 Nov 2026); forwarded through label pjed5hzx under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemix-cdn07-hk07.club",
   "note": "Moved host to host: host 4 (3 Nov 2026), then host 3 (8 Nov 2026); forwarded through label nwzmhugj under ikunzf.online; on a threat list NSS takes in, list date 18 Oct 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "2026-10-18",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeniam-cdn2-hk23.autos",
   "note": "Moved host to host: host 3 (7 Nov 2026), then host 5 (8 Nov 2026); forwarded through label 8px9g4dv under ikunzf.online; on a threat list NSS takes in, list date 8 Nov 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "2026-11-08",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenim-cdn-sg.biz",
   "note": "Moved host to host: host 1 (31 Oct 2026), then host 5 (7 Nov 2026); forwarded through label a8j3sbuf under ikunzf.online; on a threat list NSS takes in, list date 26 Sep 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-09-26",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenim-cdn27-hk3.monster",
   "note": "Moved host to host: host 4 (10 Nov 2026), then host 6 (12 Nov 2026); forwarded through label du7v5eky under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenmi.vip",
   "note": "Moved host to host: host 5 (9 Nov 2026), then host 6 (12 Nov 2026); forwarded through label 2r36s5d9 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokevim-cdn26-hk26.club",
   "note": "Moved host to host: host 4 (3 Nov 2026), then host 3 (8 Nov 2026); forwarded through label gq8z52rc under ikunzf.online; on a threat list NSS takes in, list date 18 Oct 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "2026-10-18",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokevim-cdn90-hk90.club",
   "note": "Moved host to host: host 5 (3 Nov 2026), then host 2 (3 Nov 2026), then host 3 (8 Nov 2026); forwarded through label g28xpcsa under ikunzf.online; on a threat list NSS takes in, list date 18 Oct 2026",
   "layer": "moved-name",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "2026-10-18",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "hellogpt-cdn.club",
   "note": "On host 6 from 13 Nov 2026; forwarded through label fmr635hz under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "mtokeni.biz",
   "note": "On host 5 from 9 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "teiegram-ca.com",
   "note": "On host 6 from 13 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "teiegram-cs.com",
   "note": "On host 6 from 14 Nov 2026; forwarded through label tkxrznq9 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "timeaim-cdn3-hk7.lol",
   "note": "On host 4 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokaimn-cdn89-hk25.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label mtup86xv under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokairvm-cdn83-hk84.click",
   "note": "On host 6 from 11 Nov 2026; forwarded through label 45tyur97 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokaixen-cdn84-hk29.cfd",
   "note": "On host 5 from 9 Nov 2026; forwarded through label 9kyd4q5x under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokanimx-cdn63-hk33.lol",
   "note": "On host 6 from 14 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokanix-cdn87-hk43.lol",
   "note": "On host 5 from 7 Nov 2026; forwarded through label fgkvctup under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeaim-cdn09-hk44.autos",
   "note": "On host 6 from 11 Nov 2026; forwarded through label 6jmp4s2k under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeaivem-cdn34-hk77.pics",
   "note": "On host 6 from 11 Nov 2026; forwarded through label 4px73rny under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeaixm-cdn20-hk39.baby",
   "note": "On host 6 from 11 Nov 2026; forwarded through label uw7ckhgz under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeiaem-cdn20-hk65.lol",
   "note": "On host 6 from 14 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeiemi-cdn39-hk83.sbs",
   "note": "On host 6 from 14 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeikme-cdn64-hk54.lol",
   "note": "On host 4 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeimx-cdnnode-sg16.xyz",
   "note": "On host 3 from 7 Nov 2026; on a threat list NSS takes in, list date 10 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "2026-11-10",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeincm-cdn13-hk18.baby",
   "note": "On host 6 from 14 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeins-cdn8-hk42.lol",
   "note": "On host 5 from 8 Nov 2026; forwarded through label jgrd8267 under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-08",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeinsm-cdn8-hk4.beauty",
   "note": "On host 3 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeirm-cdn04-hk36.xyz",
   "note": "On host 5 from 9 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeixm-cdn19-hk84.lol",
   "note": "On host 6 from 14 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokemie-cdn6-hk1.cfd",
   "note": "On host 5 from 5 Nov 2026; forwarded through label wxtqhmbu under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-05",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemien-cdn6-hk65.click",
   "note": "On host 3 from 9 Nov 2026; forwarded through label b82anjg6 under ikunzf.online; on a threat list NSS takes in, list date 8 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "2026-11-08",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemim-cdn2-hk2.click",
   "note": "On host 3 from 5 Nov 2026; forwarded through label bc95yztu under ikunzf.online; on a threat list NSS takes in, list date 3 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-05",
   "list_date": "2026-11-03",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemim-cdn73-hk73.club",
   "note": "On host 4 from 3 Nov 2026; forwarded through label jmy8rane under ikunzf.online; on a threat list NSS takes in, list date 15 Oct 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-03",
   "list_date": "2026-10-15",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemine-cdn07-hk6.monster",
   "note": "On host 4 from 7 Nov 2026; forwarded through label 2stqnbc3 under ikunzf.online; on a threat list NSS takes in, list date 7 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "2026-11-07",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemine-cdn21-hk8.lol",
   "note": "On host 3 from 7 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemirn-cdn21-hk83.autos",
   "note": "On host 3 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokemixn-cdn51-hk29.autos",
   "note": "On host 6 from 13 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeniam-cdn04-hk38.lat",
   "note": "On host 6 from 12 Nov 2026; forwarded through label 7j6etn28 under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-12",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeniam-cdn2-hk23.lat",
   "note": "On host 3 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenianv-cdn55-hk35.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label z26urbxa under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeniem-cdn04-hk31.lol",
   "note": "On host 6 from 12 Nov 2026; forwarded through label 9r2b8vj7 under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-12",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeniem-cdn11-hk41.click",
   "note": "On host 6 from 11 Nov 2026; forwarded through label 593c2suq under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokeniem-cdn61-hk46.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label mw47hy56 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokeniern-cdn4-hk12.lol",
   "note": "On host 5 from 8 Nov 2026; forwarded through label arz4mfpu under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-08",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenimx-cdn-edge-hk07.club",
   "note": "On host 2 from 5 Nov 2026; forwarded through label cpmjvzts under ikunzf.online; on a threat list NSS takes in, list date 30 Oct 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-05",
   "list_date": "2026-10-30",
   "nss_verdict_14_nov_2026": "Suspicious",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenirm-cdn72-hk84.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label jrhbc437 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn01-hk31.cfd",
   "note": "On host 6 from 11 Nov 2026; forwarded through label bnjhua7r under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn08-hk39.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label vmtnszfj under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn08-hk52.quest",
   "note": "On host 6 from 11 Nov 2026; forwarded through label 4q5tusab under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn17-hk17.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label j8mhacg6 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn27-hk33.pics",
   "note": "On host 3 from 8 Nov 2026; forwarded through label ytvwan3s under ikunzf.online; on a threat list NSS takes in, list date 8 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-08",
   "list_date": "2026-11-08",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn52-hk13.autos",
   "note": "On host 6 from 11 Nov 2026; forwarded through label dkprt6mu under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn58-hk84.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label eaztcmur under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn81-hk08.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label qkvd7nj2 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenism-cdn94-hk19.lat",
   "note": "On host 6 from 11 Nov 2026; forwarded through label at73egds under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenixm-cdn12-hk65.lol",
   "note": "On host 6 from 11 Nov 2026; forwarded through label reaqbxjy under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokennim-cdn57-hk16.click",
   "note": "On host 4 from 5 Nov 2026; forwarded through label km9e8wdj under ikunzf.online; on a threat list NSS takes in, list date 1 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-05",
   "list_date": "2026-11-01",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokenpoket.vip",
   "note": "On host 6 from 13 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenpoketcim-pop-sg31.xyz",
   "note": "On host 6 from 13 Nov 2026; forwarded through label 4tw68va7 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenpoketina-edge-tw39.click",
   "note": "On host 6 from 13 Nov 2026; forwarded through label x2sb4rpu under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenpoketnerm-cdn-sg54.beauty",
   "note": "On host 6 from 13 Nov 2026; forwarded through label dzfb2754 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenpoketnv-cdn-jp28.xyz",
   "note": "On host 6 from 13 Nov 2026; forwarded through label zyd8c6ab under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenpoketpaime-cdn-uk84.lol",
   "note": "On host 6 from 13 Nov 2026; forwarded through label wdqjf4sr under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenpoketprie-cdn-uk21.xyz",
   "note": "On host 6 from 13 Nov 2026; forwarded through label mueazxg4 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenpoketprnv-gw-sg16.xyz",
   "note": "On host 6 from 13 Nov 2026; forwarded through label 7ywcxf34 under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-13",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokenram-cdn81-hk41.monster",
   "note": "On host 6 from 11 Nov 2026; forwarded through label at953dsb under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokevim-cdn-hk0.homes",
   "note": "On host 1 from 31 Oct 2026; forwarded through label 5nqxe7yd under ikunzf.online; on a threat list NSS takes in, list date 31 Oct 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-10-31",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokevim-cdn0-hk43.cfd",
   "note": "On host 6 from 12 Nov 2026; forwarded through label xfmbevpq under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-12",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokevim-cdn32-hk61.lol",
   "note": "On host 1 from 27 Oct 2026; forwarded through label 8v75jux4 under ikunzf.online; on a threat list NSS takes in, list date 27 Oct 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-10-27",
   "list_date": "2026-10-27",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokevim-cdn83-hk49.lol",
   "note": "On host 1 from 31 Oct 2026; forwarded through label jq25hwxu under ikunzf.online; on a threat list NSS takes in, list date 31 Oct 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-10-31",
   "list_date": "2026-10-31",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokevixn-cdn09-hk6.lol",
   "note": "On host 5 from 7 Nov 2026; forwarded through label 86ebmh2n under ikunzf.online; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokexim-cdn35-hk6.lol",
   "note": "On host 4 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokieiarm-cdn45-hk73.click",
   "note": "On host 6 from 14 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokieninn-cdn18-hk79.homes",
   "note": "On host 5 from 9 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokienxm-cdn8-hk43.sbs",
   "note": "On host 3 from 8 Nov 2026; forwarded through label 5xemrwdj under ikunzf.online; on a threat list NSS takes in, list date 8 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-08",
   "list_date": "2026-11-08",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokinbin-cdn38-hk52.xyz",
   "note": "On host 5 from 9 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokiniem-cdn05-hk9.lol",
   "note": "On host 3 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokinim-cdn18-hk7.lol",
   "note": "On host 3 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokinim-cdn41-hk41.club",
   "note": "On host 3 from 5 Nov 2026; forwarded through label u4qmrh9e under ikunzf.online; on a threat list NSS takes in, list date 22 Oct 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-05",
   "list_date": "2026-10-22",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokininx-cdn18-hk78.lol",
   "note": "On host 3 from 8 Nov 2026; forwarded through label z5x6jr8n under ikunzf.online; on a threat list NSS takes in, list date 8 Nov 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-08",
   "list_date": "2026-11-08",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokinix-cdn21-hk21.club",
   "note": "On host 2 from 5 Nov 2026; forwarded through label kh59pnq3 under ikunzf.online; on a threat list NSS takes in, list date 22 Oct 2026",
   "layer": "name",
   "nss_first_record_utc": "2026-11-05",
   "list_date": "2026-10-22",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokirvimcdn35-hk21.blog",
   "note": "On host 6 from 14 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-14",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "tokrnims-cdn7-hk75.lol",
   "note": "On host 3 from 10 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-10",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokrnixin-cdn7-hk73.lol",
   "note": "On host 3 from 7 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-07",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tokrnixin-cdn97-hk7.xyz",
   "note": "On host 5 from 9 Nov 2026; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-09",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "tolearn-cdn30-hk24.beauty",
   "note": "On host 6 from 11 Nov 2026; forwarded through label e2ycb5ug under yumsihjkk.cc; on no threat list NSS takes in (14 Nov 2026)",
   "layer": "name",
   "nss_first_record_utc": "2026-11-11",
   "list_date": "",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "dedicated"
  },
  {
   "type": "domain",
   "value": "app.app-lestalk.com.cn",
   "note": "Fake-software download name in the same forwarding layer (a label under ikunzf.online in NSS's record); on a threat list NSS takes in, list date 10 Nov 2026; not attributed to the operator",
   "layer": "download",
   "nss_first_record_utc": "",
   "list_date": "2026-11-10",
   "nss_verdict_14_nov_2026": "Suspicious",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "download-sougou.com.cn",
   "note": "Fake-software download name in the same forwarding layer (a label under ikunzf.online in NSS's record); on a threat list NSS takes in, list date 31 Aug 2026; not attributed to the operator",
   "layer": "download",
   "nss_first_record_utc": "2026-10-26",
   "list_date": "2026-08-31",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "download.google-chrome.cyou",
   "note": "Fake-software download name in the same forwarding layer (a label under ikunzf.online in NSS's record); on a threat list NSS takes in, list date 15 Mar 2026; not attributed to the operator",
   "layer": "download",
   "nss_first_record_utc": "",
   "list_date": "2026-03-15",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  },
  {
   "type": "domain",
   "value": "download.tfyxzai.com",
   "note": "Fake-software download name in the same forwarding layer (a label under ikunzf.online in NSS's record); on a threat list NSS takes in, list date 6 Aug 2026; not attributed to the operator",
   "layer": "download",
   "nss_first_record_utc": "",
   "list_date": "2026-08-06",
   "nss_verdict_14_nov_2026": "High risk",
   "host_type": "n/a (no address at the read)"
  }
 ]
}