Explainers
Topics
Plain explainers for SOC analysts on the infrastructure NSS research covers. Each one is written from NSS's own papers, copies their numbers and links to them for the evidence.
- Lookalike domains
How lookalike and bulk-bought domains are built, why a name pattern is not proof, and how registration batches tie names together. From NSS papers WA-01, OC-01.
Written from NSS-WA-01 and NSS-OC-01. 5 min read.
- Fake software update lures
How a fake Zoom update page works, why it passes scanners, how NSS traced it to a remote-access installer within 23 hours, and what a defender can look for.
Written from NSS-ZM-01. 4 min read.
- Remote-access tool abuse
How attackers use self-hosted remote-support clients such as ScreenConnect as a payload, how NSS traced one to its server, and the controls that catch it.
Written from NSS-ZM-01. 3 min read.
- Redirect and throwaway domains
Throwaway names that redirect to lottery and betting pages sit behind a shared delivery network. How NSS ties them by label and batch, not address (NSS-RH-01).
Written from NSS-RH-01. 4 min read.
- How NSS confirms infrastructure
The public records NSS papers rest on, the links that count and the ones that do not, how times and counts are stated, and the limits every NSS paper states.
Written from NSS-WA-01, NSS-OC-01, NSS-RH-01 and NSS-ZM-01. 4 min read.
The terms used in NSS research, in plain language. Each one links to the papers and topic pages where it appears. 38 terms.
The papers themselves are on the Research page.