ONYPHE
LightNews LightNews
banner
onyphe.io
ONYPHE
@onyphe.io
130 followers 56 following 43 posts
Provider of Attack Surface Discovery (ASD), Attack Surface Management (ASM) and CTI solutions. Scanning at Internet-scale since 2017 - contact at onyphe dot io
Posts Replies Media Videos
Pinned
onyphe.io
ONYPHE @onyphe.io · Jan 31
🎉 Retrospective 2024 and Roadmap 2025

👉 Over the last 12 months, we massively increased our visibility of Internet exposed assets. Until now, we focused on #ASM, but this year we will improve our automatic #ASD and expand into the #CTI segment.

Read more: search.onyphe.io/docs/write-u...
Reposted by ONYPHE
hrbrmstr.dev
For personal use I added a "geolocus" tool to a Deno-based MCP server (that has alot of random tools/functions in it).

It's been useful enough that I started extracting it to a standalone geolocus MCP server I shld be able to release in a couple days.

The @onyphe.io folks are super rad.
June 3, 2025 at 2:22 AM
onyphe.io
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #Ivanti product:

CVE-2025-4427+CVE-2025-4428 unauth RCE

search.onyphe.io/search?q=cat...

Thanks to watchTowr for detection method.
May 16, 2025 at 10:08 AM
Reposted by ONYPHE
hrbrmstr.mastodon.social.ap.brid.gy
ONYPHE has a super cool geolocus MMDB — https://www.geolocus.io/ — that gets updated daily and has network-level metadata for IP addresses (ref first image JSON).

Since it's way more efficient to use this than their API, I built a cross-platform CLI tool for […]

[Original post on mastodon.social]
The image shows a block of structured JSON data displayed on a dark background. The JSON object has the following top-level structure: • abuse: A list of four email addresses related to reporting abuse at Amazon and AWS: • amzn-noc-contact@amazon.com • aws-routing-poc@amazon.com • aws-rpki-routing-poc@amazon.com • trustandsafety@support.aws.com • asn: "AS14618" (This is Amazon’s autonomous system number.) • continent: "NA" (North America) • continentname: "North America" • country: "US" (United States) • countryname: "United States" • domain: A list of three domains: • amazon.com • amazonaws.com • aws.com • ip: "3.215.138.152" (The specific IP address being described.) • isineu: 0 (Indicates whether the IP is in the European Union — 0 means no.) • latitude: "37.09024" • longitude: "-95.712891" • location: "37.09024, -95.712891" • netname: "AMAZON-IAD" (The name of the network.) • organization: "Amazon Data Services NoVa" • physical_asn: "AS14618" • physical_continent: "NA" • physical_continentname: "North America" • physical_country: "US" • physical_countryname: "United States" • physical_isineu: 0 • physical_latitude: "37.09024" • physical_longitude: "-95.712891" • physical_location: "37.09024, -95.712891" • physical_organization: "Amazon.com, Inc." • physical_subnet: "3.208.0.0/12" • physical_timezone: "America/Chicago" • subnet: "3.208.0.0/12" • timezone: "America/Chicago" Usage # Download the latest Geolocus database geolocus-cli download # Look up IPs from a file geolocus-cli lookup -i ips.txt -o results.json # Process IPs from stdin and output to stdout cat ips.txt | geolocus-cli lookup # Output in CSV format geolocus-cli lookup -i ips.txt -f csv -o results.csv # Output in JSONL format (one JSON object per line) geolocus-cli lookup -i ips.txt -f jsonl -o results.jsonl # Disable session caching geolocus-cli lookup -i ips.txt --no-cache Command-line Options Commands: download Download a fresh copy of the geolocus.mmdb database lookup Lookup and enrich IP addresses from a file or stdin Options: -h, --help Show help information -i, --input <file> Input file containing IP addresses (one per line) -o, --output <file> Output file for results (defaults to stdout) -f, --format <format> Output format: json, csv, or jsonl (default: json) --no-cache Disable IP caching for the current session
April 27, 2025 at 5:09 PM
Reposted by ONYPHE
hacker.at.thenote.app
New geolocus-cli For ONYPHE’s Geolocus Database

ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "amzn-noc-contact@amazon.com", "aws-routing-poc@amazon.com", "aws-rpki-routing…

#hackernews #news
New geolocus-cli For ONYPHE’s Geolocus Database
ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "amzn-noc-contact@amazon.com", "aws-routing-poc@amazon.com", "aws-rpki-routing-poc@amazon.com", "trustandsafety@support.aws.com" ], "asn": "AS14618", "continent": "NA", "continentname": "North America", "country": "US", "countryname": "United States", "domain": [ "amazon.com", "amazonaws.com", "aws.com" ], "ip": "3.215.138.152", "isineu": 0, […]
securityboulevard.com
April 28, 2025 at 2:01 PM
onyphe.io
The recovery continues, but things are not yet back to normal
April 29, 2025 at 4:54 AM
onyphe.io
Things are not yet getting better in Spain and Portugal. General downward trend and some visible instability in the remaining networks that are reachable.

#PowerOutage
Chart showing Internet scan data for France, Spain and Portugal. Spain and Portugal show significant drops in devices responding at 12:30, and some significant instability visible in Spanish networks from 17:00 to 20:00
April 28, 2025 at 6:47 PM
onyphe.io
The electrical power outage in Spain and Portugal as seen from the Internet (France included for reference)
A chart showing Internet scan data plots for three countries; Spain, Portugal and France. The three lines are stable, with minor variations from 09:00 to 12:30. At 12:30 the lines for Spain and Portugal drop almost vertically to roughly 50% of their original levels. The line for France continues as for the start of the day. The lines for Spain and Portugal have not returned to their original levels.
April 28, 2025 at 4:03 PM
onyphe.io
#CVE-2025-32432 #0day #CraftCMS discovered by Orange Cyberdefense

💥Unauthenticated Remote Code Execution. No CVSS yet, we suggest to give it a 10

📌40,000 IP addresses representing over 37,000 domain names exposed, 12,168 unique domains vulnerable

Blog:

blog.onyphe.io/en/cve-2025-...
CVE-2025-32432 – 0day Craft CMS discovered by Orange Cyberdefense – Blog | Big Data for Cyber Defense
blog.onyphe.io
April 25, 2025 at 3:45 PM
onyphe.io
UPDATE: our scan has finished, near 22,000 devices are compromised.
onyphe.io ONYPHE @onyphe.io · Apr 21
💥Detection method for #symlink #backdoor on #fortinet

"we are willing to share it, privately"

More than 18k devices compromised

Read more: blog.onyphe.io/en/symlink-b...
Symlink backdoor on Fortinet SSL-VPN devices – Blog | Big Data for Cyber Defense
blog.onyphe.io
April 22, 2025 at 1:48 PM
onyphe.io
💥Méthode de détection de la #backdoor #symlink sur #fortinet

"nous sommes prêts à la partager, en privé"

Plus de 18,000 équipements compromis

Lire l'article : blog.onyphe.io/backdoor-sym...
Backdoor symlink sur des VPN SSL Fortinet – Blog | Big Data for Cyber Defense
blog.onyphe.io
April 21, 2025 at 12:50 PM
onyphe.io
💥Detection method for #symlink #backdoor on #fortinet

"we are willing to share it, privately"

More than 18k devices compromised

Read more: blog.onyphe.io/en/symlink-b...
Symlink backdoor on Fortinet SSL-VPN devices – Blog | Big Data for Cyber Defense
blog.onyphe.io
April 21, 2025 at 12:49 PM
onyphe.io
Time to search for a decentralized way to deal with vulnerability identifiers.
April 16, 2025 at 11:36 AM
Reposted by ONYPHE
hrbrmstr.dev
And there's an #RStats package for it—now.

codeberg.org/hrbrmstr/geo...
March 24, 2025 at 8:38 AM
onyphe.io
❓Ever wanted to have an IP geolocation database with 2 locations, one physical for the device and one logical from whois data?

👉We provide a free MMDB file for download and a brand new Website for lookups & even a free API access:

www.geolocus.io
Geolocus by ONYPHE
Geolocus is an IPv4 & IPv6 geolocation service. Our motto is: you don't need misleading GPS coordinates, you need trusted IP to country locations. Furthermore, an IP address truly has 2 locations: 1 l...
www.geolocus.io
March 24, 2025 at 7:46 AM
Reposted by ONYPHE
maliciarogue.bsky.social
👓La Cyber-revue à bas bruit est de retour ! L'alpha et l'oméga de cette édition : les zero days. C'est... surprenant 😇

Et aussi un podcast (coucou @nolimitsecu.bsky.social), des chiffres passionnants d' @onyphe.io et de La tech est politique et sa nouvelle rubrique.
www.linkedin.com/pulse/zero-d...
Zero Day
Bonjour ☕ Bienvenue dans la Cyber-revue à bas bruit de la semaine. Je sais, ça fait un bail, mais : j'ai eu des semaines de ouf (dont une qui s'est finie avec votre dévouée bloquée à Bruxelles pour ca...
www.linkedin.com
March 23, 2025 at 2:01 PM
onyphe.io
The latest version of our cli tool has been released. Get v4.19.0 and find wrappers with sweet new APIs inside.

Available here ➡️
search.onyphe.io/docs/onyphe-...

or here 🐳 hub.docker.com/r/onyphe/ony...

or even here 🥷 metacpan.org/dist/Onyphe
Installation | ONYPHE
Installation
search.onyphe.io
March 18, 2025 at 6:54 AM
onyphe.io
💥 Great news 💥

#ASD #AttackSurfaceDiscovery APIs are on their way to general availability.

It will never be as easy to create an asset inventory for any organization attack surface #EASM

Backed by 10th of billions of informations we collect.
March 1, 2025 at 5:37 PM
Reposted by ONYPHE
stalkphish.bsky.social
📣 Meet Thomas Damonneville - our founder - at the #M3AAWG organized by the Messaging, Malware, Mobile Anti-Abuse Working Group in Lisbon next week for his presentation entitled: “Hunting for phishing URLs, kits and business”.

👋 In partnership with Signal Spam

#phishing #phishingkit #cybersecurity
February 15, 2025 at 6:20 PM
onyphe.io
Yes, still 50k compromised devices. Since more than 12 months.
jamesatack.com James Atack @jamesatack.com · Feb 14
A thousand you say?

In December 2024 you say?

@insikt.bsky.social

Is this not just badcandy again?

because those telcos and universities have been owned for much longer than that via CVE-2023-20198. They just periodically have to recompromise them as they get rebooted.

Also try 50k devices.
infosec.skyfleet.blue InfoSec @infosec.skyfleet.blue · Feb 14
RedMike Hackers Exploited 1000+ Cisco Devices to Gain Admin Access
February 14, 2025 at 12:21 PM
onyphe.io
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #PaloAltoNetworks PA product:

CVE-2025-0108: authentication bypass on management interface

search.onyphe.io/search?q=cat...

Thanks to @assetnote.io for having shared the detection method.
February 14, 2025 at 9:16 AM
Reposted by ONYPHE
jamesatack.com
Yet by performing an awkward legal waltz around the subject, Talos have helpfully supported my hypothesis that compromised IOS XE devices are part of an ORB network serving multiple APTs.

archive.hack.lu/hack-lu-2024...
The XE Files - Trust No Router hack.lu 2024
On the 16th October 2023 Cisco Talos shared intelligence about a handful of compromised routers discovered while resolving customer support requests. As the full story unfolded, a handful of backdoore...
archive.hack.lu
February 12, 2025 at 9:21 AM
onyphe.io
🎉 Retrospective 2024 and Roadmap 2025

👉 Over the last 12 months, we massively increased our visibility of Internet exposed assets. Until now, we focused on #ASM, but this year we will improve our automatic #ASD and expand into the #CTI segment.

Read more: search.onyphe.io/docs/write-u...
January 31, 2025 at 2:22 PM
Reposted by ONYPHE
jamesatack.com
we tag it at a risky protocol

there are 2.2M results for Windows RPC boxes
onyphe ctiscan result showing the number of rpc protocol exposed on Windows boxes, that is 2193060 found in 0.26 seconds
January 3, 2025 at 9:56 AM
onyphe.io
Cc @greynoise.infosec.exchange.ap.brid.gy
onyphe.io ONYPHE @onyphe.io · Jan 21
🪘 That's probably the best advertisement we may have: an independent benchmark from GreyNoise Intelligence about benign Internet scanning activity. It shows our #scanning technology can give you a better view on your exposed assets that cyber-criminals.
January 21, 2025 at 4:00 PM
onyphe.io
🪘 That's probably the best advertisement we may have: an independent benchmark from GreyNoise Intelligence about benign Internet scanning activity. It shows our #scanning technology can give you a better view on your exposed assets that cyber-criminals.
January 21, 2025 at 1:20 PM