Tessera

ONYPHE

@onyphe.io

Provider of Attack Surface Discovery (ASD), Attack Surface Management (ASM) and CTI solutions. Scanning at Internet-scale since 2017 - contact at onyphe dot io

52 Posts142 Follower 61 Folgt

CyberVeille @cyberveille-ch.bsky.social · last wk.

📢 Frigo d’importance vitale : au-delà de Danfoss, l’exposition des systèmes de supervision Copeland/Dixell Dans le prolongement de l’investigation sur l’exposition des contrôleurs Danfoss StoreView, ONYPHE élargit son analyse à trois autres familles de systèmes de supe… #Vulnérabilité #Cyberveille

Frigo d’importance vitale : au-delà de Danfoss, l’exposition des systèmes de supervision Copeland/Dixell

Dans le prolongement de l’investigation sur l’exposition des contrôleurs Danfoss StoreView, ONYPHE élargit son analyse à trois autres familles de systèmes de supervision : Copeland Site Supervisor…

blog.onyphe.io

ONYPHE @onyphe.io · 9mo ago

🏁 La nouvelle année est déjà entamée, c’est le moment de revenir sur 2025 et de lister ce que nous avons fait chez @onyphe.io. C’est également le moment de parler des évolutions à venir. Et c’est encore une fois ambitieux, comme chaque année chez nous: blog.onyphe.io/rtrospective...

Rétrospective 2025 et feuille de route 2026 – Blog | Big Data for Cyber Defense

blog.onyphe.io

ONYPHE @onyphe.io · 9mo ago

📣 Just added 400 new ports to scan 👀 Total: 3,000+ ports - weekly refresh #ASM #Internet #Scanner

ONYPHE @onyphe.io · 10mo ago

📣 UPDATE: now scanning 2,600+ ports, weekly refresh.

ONYPHE@onyphe.io · 10mo ago

📣 ANNOUNCEMENT: we have reached the 2,100+ scanned ports milestone, at Internet scale with a weekly refresh rate. Next step: 5,000+ ports, weekly refresh. Then 10,000 by end of next year. We will be the competitor number 1 to @censys.bsky.social in 2026. #ASM #CTI #ASD

ONYPHE @onyphe.io · 10mo ago

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #n8n product: CVE-2026-21858: unauthenticated remote code execution #Ni8mare search.onyphe.io/search?q=cat...

ONYPHE @onyphe.io · 10mo ago

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #SmarterMail product: CVE-2025-52691: remote unauthenticated file upload & overwrite search.onyphe.io/search?q=cat...

ONYPHE @onyphe.io · 10mo ago

📣 UPDATE: new vulnerable IPs count is ~100K. Our first request was not the most suited one and was updated. 👍 That's why it's important for organizations to communicate on such critical issues: it helps everyone improve for the greater good.

ONYPHE@onyphe.io · 10mo ago

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #MongoDB product: CVE-2025-14847: remote unauthenticated memory reading #MongoBleed search.onyphe.io/search?q=cat...

ONYPHE @onyphe.io · 10mo ago

ONYPHE @onyphe.io · 11mo ago

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #WatchGuard Firebox: CVE-2025-14733: unauthenticated remote code execution through out of bound writes No one has patched yet, everyone is vulnerable.

hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈@hrbrmstr.dev · last yr.

For personal use I added a "geolocus" tool to a Deno-based MCP server (that has alot of random tools/functions in it). It's been useful enough that I started extracting it to a standalone geolocus MCP server I shld be able to release in a couple days. The @onyphe.io folks are super rad.

ONYPHE @onyphe.io · last yr.

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #Ivanti product: CVE-2025-4427+CVE-2025-4428 unauth RCE search.onyphe.io/search?q=cat... Thanks to watchTowr for detection method.

hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪 4 @hrbrmstr.mastodon.social.ap.brid.gy · 2y ago

ONYPHE has a super cool geolocus MMDB — https://www.geolocus.io/ — that gets updated daily and has network-level metadata for IP addresses (ref first image JSON). Since it's way more efficient to use this than their API, I built a cross-platform CLI tool for […] [Original post on mastodon.social]

The image shows a block of structured JSON data displayed on a dark background.

The JSON object has the following top-level structure:
• abuse:
A list of four email addresses related to reporting abuse at Amazon and AWS:
• amzn-noc-contact@amazon.com
• aws-routing-poc@amazon.com
• aws-rpki-routing-poc@amazon.com
• trustandsafety@support.aws.com
• asn: "AS14618"
(This is Amazon’s autonomous system number.)
• continent: "NA" (North America)
• continentname: "North America"
• country: "US" (United States)
• countryname: "United States"
• domain:
A list of three domains:
• amazon.com
• amazonaws.com
• aws.com
• ip: "3.215.138.152"
(The specific IP address being described.)
• isineu: 0
(Indicates whether the IP is in the European Union — 0 means no.)
• latitude: "37.09024"
• longitude: "-95.712891"
• location: "37.09024, -95.712891"
• netname: "AMAZON-IAD"
(The name of the network.)
• organization: "Amazon Data Services NoVa"
• physical_asn: "AS14618"
• physical_continent: "NA"
• physical_continentname: "North America"
• physical_country: "US"
• physical_countryname: "United States"
• physical_isineu: 0
• physical_latitude: "37.09024"
• physical_longitude: "-95.712891"
• physical_location: "37.09024, -95.712891"
• physical_organization: "Amazon.com, Inc."
• physical_subnet: "3.208.0.0/12"
• physical_timezone: "America/Chicago"
• subnet: "3.208.0.0/12"
• timezone: "America/Chicago"

Usage
# Download the latest Geolocus database
geolocus-cli download

# Look up IPs from a file
geolocus-cli lookup -i ips.txt -o results.json

# Process IPs from stdin and output to stdout
cat ips.txt | geolocus-cli lookup

# Output in CSV format
geolocus-cli lookup -i ips.txt -f csv -o results.csv

# Output in JSONL format (one JSON object per line)
geolocus-cli lookup -i ips.txt -f jsonl -o results.jsonl

# Disable session caching
geolocus-cli lookup -i ips.txt --no-cache

Command-line Options
Commands:
download Download a fresh copy of the geolocus.mmdb database
lookup Lookup and enrich IP addresses from a file or stdin

Options:
-h, --help Show help information
-i, --input <file> Input file containing IP addresses (one per line)
-o, --output <file> Output file for results (defaults to stdout)
-f, --format <format> Output format: json, csv, or jsonl (default: json)
--no-cache Disable IP caching for the current session

Hacker & Security News @hacker.at.thenote.app · 2y ago

New geolocus-cli For ONYPHE’s Geolocus Database ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "amzn-noc-contact@amazon.com", "aws-routing-poc@amazon.com", "aws-rpki-routing… #hackernews #news

New geolocus-cli For ONYPHE’s Geolocus Database

ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "amzn-noc-contact@amazon.com", "aws-routing-poc@amazon.com", "aws-rpki-routing-poc@amazon.com", "trustandsafety@support.aws.com" ], "asn": "AS14618", "continent": "NA", "continentname": "North America", "country": "US", "countryname": "United States", "domain": [ "amazon.com", "amazonaws.com", "aws.com" ], "ip": "3.215.138.152", "isineu": 0, […]

securityboulevard.com

ONYPHE @onyphe.io · 2y ago

The recovery continues, but things are not yet back to normal

ONYPHE@onyphe.io · 2y ago

Things are not yet getting better in Spain and Portugal. General downward trend and some visible instability in the remaining networks that are reachable. #PowerOutage

ONYPHE @onyphe.io · 2y ago

Things are not yet getting better in Spain and Portugal. General downward trend and some visible instability in the remaining networks that are reachable. #PowerOutage

Chart showing Internet scan data for France, Spain and Portugal. Spain and Portugal show significant drops in devices responding at 12:30, and some significant instability visible in Spanish networks from 17:00 to 20:00

ONYPHE@onyphe.io · 2y ago

The electrical power outage in Spain and Portugal as seen from the Internet (France included for reference)

A chart showing Internet scan data plots for three countries; Spain, Portugal and France. The three lines are stable, with minor variations from 09:00 to 12:30. At 12:30 the lines for Spain and Portugal drop almost vertically to roughly 50% of their original levels. The line for France continues as for the start of the day.
The lines for Spain and Portugal have not returned to their original levels.

ONYPHE @onyphe.io · 2y ago

The electrical power outage in Spain and Portugal as seen from the Internet (France included for reference)

ONYPHE @onyphe.io · 2y ago

#CVE-2025-32432 #0day #CraftCMS discovered by Orange Cyberdefense 💥Unauthenticated Remote Code Execution. No CVSS yet, we suggest to give it a 10 📌40,000 IP addresses representing over 37,000 domain names exposed, 12,168 unique domains vulnerable Blog: blog.onyphe.io/en/cve-2025-...

CVE-2025-32432 – 0day Craft CMS discovered by Orange Cyberdefense – Blog | Big Data for Cyber Defense

blog.onyphe.io

ONYPHE @onyphe.io · 2y ago

UPDATE: our scan has finished, near 22,000 devices are compromised.

ONYPHE@onyphe.io · 2y ago

💥Detection method for #symlink #backdoor on #fortinet "we are willing to share it, privately" More than 18k devices compromised Read more: blog.onyphe.io/en/symlink-b...

ONYPHE @onyphe.io · 2y ago

💥Méthode de détection de la #backdoor #symlink sur #fortinet "nous sommes prêts à la partager, en privé" Plus de 18,000 équipements compromis Lire l'article : blog.onyphe.io/backdoor-sym...

Backdoor symlink sur des VPN SSL Fortinet – Blog | Big Data for Cyber Defense

blog.onyphe.io

ONYPHE @onyphe.io · 2y ago

💥Detection method for #symlink #backdoor on #fortinet "we are willing to share it, privately" More than 18k devices compromised Read more: blog.onyphe.io/en/symlink-b...

Symlink backdoor on Fortinet SSL-VPN devices – Blog | Big Data for Cyber Defense

blog.onyphe.io

ONYPHE @onyphe.io · 2y ago

Time to search for a decentralized way to deal with vulnerability identifiers.

Guillaume Assier ⛅@guillaume.engineer · 2y ago

Plus de CVE, plus de problèmes 😏 www.techzine.eu/news/securit...

hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈@hrbrmstr.dev · 2y ago

And there's an #RStats package for it—now. codeberg.org/hrbrmstr/geo...

geolocus

geolocus R Package

codeberg.org

ONYPHE@onyphe.io · 2y ago

❓Ever wanted to have an IP geolocation database with 2 locations, one physical for the device and one logical from whois data? 👉We provide a free MMDB file for download and a brand new Website for lookups & even a free API access: www.geolocus.io

ONYPHE @onyphe.io · 2y ago

Geolocus by ONYPHE

Geolocus is an IPv4 & IPv6 geolocation service. Our motto is: you don't need misleading GPS coordinates, you need trusted IP to country locations. Furthermore, an IP address truly has 2 locations: 1 l...

geolocus.io

Rayna 🤓🇪🇺👩‍💻📚✍️@maliciarogue.bsky.social · 2y ago

👓La Cyber-revue à bas bruit est de retour ! L'alpha et l'oméga de cette édition : les zero days. C'est... surprenant 😇 Et aussi un podcast (coucou @nolimitsecu.bsky.social), des chiffres passionnants d' @onyphe.io et de La tech est politique et sa nouvelle rubrique. www.linkedin.com/pulse/zero-d...

Zero Day

Bonjour ☕ Bienvenue dans la Cyber-revue à bas bruit de la semaine. Je sais, ça fait un bail, mais : j'ai eu des semaines de ouf (dont une qui s'est finie avec votre dévouée bloquée à Bruxelles pour ca...

linkedin.com

ONYPHE @onyphe.io · 2y ago

The latest version of our cli tool has been released. Get v4.19.0 and find wrappers with sweet new APIs inside. Available here ➡️ search.onyphe.io/docs/onyphe-... or here 🐳 hub.docker.com/r/onyphe/ony... or even here 🥷 metacpan.org/dist/Onyphe

Installation | ONYPHE

Installation

search.onyphe.io

ONYPHE @onyphe.io · 2y ago

💥 Great news 💥 #ASD #AttackSurfaceDiscovery APIs are on their way to general availability. It will never be as easy to create an asset inventory for any organization attack surface #EASM Backed by 10th of billions of informations we collect.

-= StalkPhish =-@stalkphish.bsky.social · 2y ago

📣 Meet Thomas Damonneville - our founder - at the #M3AAWG organized by the Messaging, Malware, Mobile Anti-Abuse Working Group in Lisbon next week for his presentation entitled: “Hunting for phishing URLs, kits and business”. 👋 In partnership with Signal Spam #phishing #phishingkit #cybersecurity

ONYPHE @onyphe.io · 2y ago

Yes, still 50k compromised devices. Since more than 12 months.

James Atack@jamesatack.bsky.social · 2y ago

A thousand you say? In December 2024 you say? @insikt.bsky.social Is this not just badcandy again? because those telcos and universities have been owned for much longer than that via CVE-2023-20198. They just periodically have to recompromise them as they get rebooted. Also try 50k devices.

ONYPHE @onyphe.io · 2y ago

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #PaloAltoNetworks PA product: CVE-2025-0108: authentication bypass on management interface search.onyphe.io/search?q=cat... Thanks to @assetnote.io for having shared the detection method.