How NSS confirms infrastructure: the records behind a finding

The records

Each finding rests on records a reader can check, read at a stated time:

• Public registration records: the second a name was registered, the registrar and the status.
• A resolution check: where each name resolves and what it forwards to, for every name in the set. RH-01 checked all 319 names on 11 November 2026 between 12:04 and 12:06 UTC.
• Certificates: what the servers presented, and public certificate logs.
• Captures: NSS loads a page as a phone and as a desktop, and in ZM-01 as a crawler too, and keeps what each answered, including the pages that did not answer.
• Files read, not run. In ZM-01 NSS fetched the installer once, repeated the fetch with the same hash, read its settings and deleted it.

Each paper also names the NSS tools used and what each one did.

What counts as a link

A name that looks like another is not evidence. NSS joins names only on a shared public record:

• A registration batch: five or more names from one registrar, each within 30 seconds of the one before (OC-01, RH-01), or names in the same registration minute (WA-01).
• A shared address with a close registration or delegation time, or with the same registrar (WA-01).
• A shared forwarding label (WA-01, RH-01).
• For hosts, two or more batches that span them. One shared batch could be chance, so OC-01 keeps groups apart until a second batch joins them.

A page can add to a finding. In WA-01 NSS read a sign-in copy on 11 names; the other 40 are in the kit by the records that join them, not by a page.

What does not count

• Default name servers that a registrar gives every customer.
• A hosting company. It has many unrelated customers.
• A shared delivery network. Its addresses and its default certificate are on every customer's set-up.
• A relay service's own domain, which serves other customers.

The NSS operator pivot refuses to name an operator from a shared default. In OC-01 it refused for both the name servers and the network.

Where the judgement comes from

Papers say where the names came from. A paper marked Found by NSS describes infrastructure NSS recorded itself. A paper marked Expanded by NSS rests on names NSS recorded itself, where the pattern, or some of the names, was already on public lists. A paper marked NSS original analysis, such as OC-01, takes its names from public warning lists; the grouping, captures and checks are NSS's own work, and the judgement that the names are harmful is the lists'.

On no list NSS holds is checked on the day of publication against every list NSS takes in. It does not mean on no list anywhere.

Counts, times and addresses

• Counts are of names, not of casefile runs, unless a line says otherwise.
• Times are UTC, and each count carries the day it was read, often to the minute.
• Addresses are left out of an indicator list when the host is shared or its type is unknown. The WA-01 names sat behind a relay whose addresses serve other sites; the OC-01 host type is unknown; the RH-01 addresses belong to a shared delivery network. The ZM-01 server address is in its list, because three records tie it to the sender.
• Every indicator on a page is defanged, and every published paper is marked TLP:CLEAR.

What NSS does not claim

Every paper states its limits. These recur:

• NSS did not see who runs the sites, how visitors were sent to them, or whether anyone was harmed.
• No paper is attributed to a named group. A match in method, as in ZM-01, is not a link to an actor. See attribution.
• A batch shows one order, not one person. A reseller or a bulk tool could place orders for more than one customer.
• NSS cannot always tell a criminal lure from an authorised test. The ZM-01 page called itself a demonstration.

Correcting the record

Papers test NSS's own register as well as the outside world. OC-01 found that the register had filed its hosts as one operator on dedicated servers, while the records support three groups; the register entry is being corrected to match. RH-01 found that two blocks filed as operator clusters on dedicated hosts were part of a shared delivery network, and replaces that reading.

When NSS corrects a published result it is listed on the Corrections page with the date, what was wrong and what changed. To report an error, write to [email protected].