[{"id":"tsq-001","source":"Passive DNS aggregator (LAB)","discovered_at":"2026-05-02T08:00:00Z","confidence_score":91,"severity":"high","affected_asset":"keensafeglobalbank.com","evidence":"keensaffeglobalbank.com (registered 2026-04-30, NS=ns1.suspicious-host.tld)","recommended_action":"File takedown via registrar; add to phishing blocklist; alert customers.","mitre_mapping":["T1583.001"],"compliance_mapping":["ISO 27001 A.5.7"]},{"id":"tsq-002","source":"WHOIS monitor (LAB)","discovered_at":"2026-05-01T15:30:00Z","confidence_score":88,"severity":"high","affected_asset":"keensafeglobalbank.com","evidence":"keensafe-globabank.com (registered 2026-04-29, hosting on phishing-known IP 198.51.100.42)","recommended_action":"Open takedown ticket; add to email gateway blocklist.","mitre_mapping":["T1583.001","T1566.002"],"compliance_mapping":["NIST CSF DE.CM-1"]},{"id":"tsq-003","source":"Brand monitoring service (LAB)","discovered_at":"2026-04-29T10:14:00Z","confidence_score":84,"severity":"medium","affected_asset":"keensafeglobalbank.com","evidence":"keensafe-globalbnk.com — landing page mimics login flow.","recommended_action":"Capture screenshot, enrich with WHOIS, file at registrar.","mitre_mapping":["T1583.001","T1566.002"],"compliance_mapping":["GDPR Art.32"]},{"id":"tsq-004","source":"TLD permutation engine (LAB)","discovered_at":"2026-04-28T09:00:00Z","confidence_score":78,"severity":"medium","affected_asset":"keensafeglobalbank.com","evidence":"kensafeglobalbank.com — letter omission squat","recommended_action":"Defensive registration if available; otherwise blocklist.","mitre_mapping":["T1583.001"],"compliance_mapping":["ISO 27001 A.5.7"]},{"id":"tsq-005","source":"Phishing-page indexer (LAB)","discovered_at":"2026-04-27T18:45:00Z","confidence_score":95,"severity":"critical","affected_asset":"online.keensafeglobalbank.com","evidence":"keensafe-secure-login.com — pixel-perfect clone of login page; harvests credentials over HTTPS.","recommended_action":"Emergency takedown; notify customers; rotate session secret.","mitre_mapping":["T1566.002","T1056.003"],"compliance_mapping":["GDPR Art.34","DORA Art.19"]},{"id":"tsq-006","source":"Brand monitoring service (LAB)","discovered_at":"2026-04-25T07:20:00Z","confidence_score":70,"severity":"low","affected_asset":"keensafeglobalbank.com","evidence":"keensafeglobalbank.co (parked, no content yet)","recommended_action":"Watchlist for content changes.","mitre_mapping":["T1583.001"],"compliance_mapping":[]}]