NSS research: technical analysis of new malicious infrastructure
> research
Technical analysis from NSS: what we found, how we know, and what to block.
Found by NSS: NSS recorded this in its own data; listing state checked on the publication day. Expanded by NSS: NSS recorded these names itself; the pattern, or some of the names, was already on public lists. NSS original analysis: names came from public lists; the grouping, captures and checks are NSS's own work.
Latest NSS-TL-01 TLP:CLEAR
Expanded by NSS104 names on six servers from NSS's own resolution record, 62 first recorded by NSS's own sensors; the first server's names and the name shape were on public lists first
One wallet-phishing operator, six servers in three weeks: followed by the names it carried host to hostTwenty-four names moved with one wallet-phishing operation across six servers between 27 October and 14 November 2026, the stretch NSS's own resolution record covers; six of them went the whole way from the first server NSS recorded to the sixth, the server behind NSS-TK-01, the fake imToken download sites.
- names that moved from an earlier server to a later one; six went the whole way from the first to the sixth
- 24
- servers used by one operation between 27 October and 14 November 2026, in NSS's record
- 6
- names NSS saw on the six servers; 62 first recorded by NSS's own sensors
- 104
- names new on the current server that were on a threat list NSS takes in on 14 November; 41 of them were registered 8 to 13 November
- 0 of 43
Technical analysis
NSS original analysisLink format, check of all 19 domains and a correction, by NSS
Polish official and e-banking lookalike domains aimed at PKO business-banking users: technical analysisFrom 23 October to 5 November 2026, 19 domains built on Polish words for the authorities, the government, a company and electronic banking carried 576 one-time phishing links aimed at PKO Bank Polski's business-banking customers.Technical analysis. Published 13 Nov 2026.Found by NSS53 names from NSS's own registration records, 40 unlisted on 13 Nov; app read by NSS
Fake imToken download sites push an Android app that sends recovery phrases and private keys to one server: technical analysisCopies of imToken's Chinese website offer an Android app from outside the official store.Technical analysis. Published 13 Nov 2026.Expanded by NSS294 names from NSS's own certificate records, 284 unlisted on 13 Nov; pattern on lists since July
A name generator behind 294 Aldi and Lidl look-alike .shop names: technical analysisIn nine hours from 17:15 UTC on 12 November 2026, NSS's certificate records logged 294 .shop names that put an Aldi or Lidl label in front of a generated shop name, such as lidldeals[.]kelmsfordgrocer[.]shop.Technical analysis. Published 13 Nov 2026.Found by NSSPage, installer and server traced by NSS; 9 of 9 on no list NSS holds
Fake Zoom update page installs a self-hosted ScreenConnect client: technical analysisA page made to look like a Zoom meeting tells the visitor their app is out of date and offers an update.Technical analysis. Published 12 Nov 2026.NSS original analysisGrouping by NSS: 1,770 names tied into 98 purchase batches
Linked hosting clusters and the purchase batches behind them: technical analysisPublic warning lists carry more than 1,800 shop-style domain names that point at one hosting network.Technical analysis. Published 11 Nov 2026.Expanded by NSS100 of 319 names recorded by NSS and on no list NSS holds
Lottery redirect names on a shared delivery network: technical analysisTwo address blocks on two different networks answer for the same 319 throwaway names, and the names open Chinese-language lottery and betting pages.Technical analysis. Published 11 Nov 2026.Found by NSSAll 51 names recorded from new registrations, median 18 h
WhatsApp lookalike kit: technical analysisOver three days in late October 2026, 51 domain names imitating WhatsApp were registered in three batches, each batch within a single minute.Technical analysis. Published 10 Nov 2026.
New research by email
One plain email when NSS publishes a research paper, about one or two a month. You confirm by email first, and you can unsubscribe in one click.
> community feeds
Open to everyone, no account. Running feeds, updated through the day.
- Ransomware PulseRansomware claims counted and charted, updated through the day. Aggregates only.
- The Daily LedgerAn open daily file of the indicators that public security reporting names as hostile. Not vetted. No account, no charge.