ONYPHE
@onyphe.io
Provider of Attack Surface Discovery (ASD), Attack Surface Management (ASM) and CTI solutions. Scanning at Internet-scale since 2017 - contact at onyphe dot io
🏁 La nouvelle année est déjà entamée, c’est le moment de revenir sur 2025 et de lister ce que nous avons fait chez @onyphe.io. C’est également le moment de parler des évolutions à venir. Et c’est encore une fois ambitieux, comme chaque année chez nous: blog.onyphe.io/rtrospective...
Rétrospective 2025 et feuille de route 2026 – Blog | Big Data for Cyber Defense
blog.onyphe.io
📣 UPDATE: now scanning 2,600+ ports, weekly refresh.
ONYPHE@onyphe.io · 10mo ago📣 ANNOUNCEMENT: we have reached the 2,100+ scanned ports milestone, at Internet scale with a weekly refresh rate. Next step: 5,000+ ports, weekly refresh. Then 10,000 by end of next year. We will be the competitor number 1 to @censys.bsky.social in 2026. #ASM #CTI #ASD
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #n8n product: CVE-2026-21858: unauthenticated remote code execution #Ni8mare search.onyphe.io/search?q=cat...
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #SmarterMail product: CVE-2025-52691: remote unauthenticated file upload & overwrite search.onyphe.io/search?q=cat...
📣 UPDATE: new vulnerable IPs count is ~100K. Our first request was not the most suited one and was updated. 👍 That's why it's important for organizations to communicate on such critical issues: it helps everyone improve for the greater good.
ONYPHE@onyphe.io · 10mo ago📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #MongoDB product: CVE-2025-14847: remote unauthenticated memory reading #MongoBleed search.onyphe.io/search?q=cat...
📣 ANNOUNCEMENT: we have reached the 2,100+ scanned ports milestone, at Internet scale with a weekly refresh rate. Next step: 5,000+ ports, weekly refresh. Then 10,000 by end of next year. We will be the competitor number 1 to @censys.bsky.social in 2026. #ASM #CTI #ASD
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #MongoDB product: CVE-2025-14847: remote unauthenticated memory reading #MongoBleed search.onyphe.io/search?q=cat...
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #WatchGuard Firebox: CVE-2025-14733: unauthenticated remote code execution through out of bound writes No one has patched yet, everyone is vulnerable.
For personal use I added a "geolocus" tool to a Deno-based MCP server (that has alot of random tools/functions in it). It's been useful enough that I started extracting it to a standalone geolocus MCP server I shld be able to release in a couple days. The @onyphe.io folks are super rad.
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #Ivanti product: CVE-2025-4427+CVE-2025-4428 unauth RCE search.onyphe.io/search?q=cat... Thanks to watchTowr for detection method.
ONYPHE has a super cool geolocus MMDB — https://www.geolocus.io/ — that gets updated daily and has network-level metadata for IP addresses (ref first image JSON). Since it's way more efficient to use this than their API, I built a cross-platform CLI tool for […] [Original post on mastodon.social]
New geolocus-cli For ONYPHE’s Geolocus Database ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "amzn-noc-contact@amazon.com", "aws-routing-poc@amazon.com", "aws-rpki-routing… #hackernews #news
New geolocus-cli For ONYPHE’s Geolocus Database
ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "amzn-noc-contact@amazon.com", "aws-routing-poc@amazon.com", "aws-rpki-routing-poc@amazon.com", "trustandsafety@support.aws.com" ], "asn": "AS14618", "continent": "NA", "continentname": "North America", "country": "US", "countryname": "United States", "domain": [ "amazon.com", "amazonaws.com", "aws.com" ], "ip": "3.215.138.152", "isineu": 0, […]
securityboulevard.com
Things are not yet getting better in Spain and Portugal. General downward trend and some visible instability in the remaining networks that are reachable. #PowerOutage
ONYPHE@onyphe.io · 2y agoThe electrical power outage in Spain and Portugal as seen from the Internet (France included for reference)
The electrical power outage in Spain and Portugal as seen from the Internet (France included for reference)
#CVE-2025-32432 #0day #CraftCMS discovered by Orange Cyberdefense 💥Unauthenticated Remote Code Execution. No CVSS yet, we suggest to give it a 10 📌40,000 IP addresses representing over 37,000 domain names exposed, 12,168 unique domains vulnerable Blog: blog.onyphe.io/en/cve-2025-...
CVE-2025-32432 – 0day Craft CMS discovered by Orange Cyberdefense – Blog | Big Data for Cyber Defense
blog.onyphe.io
💥Méthode de détection de la #backdoor #symlink sur #fortinet "nous sommes prêts à la partager, en privé" Plus de 18,000 équipements compromis Lire l'article : blog.onyphe.io/backdoor-sym...
Backdoor symlink sur des VPN SSL Fortinet – Blog | Big Data for Cyber Defense
blog.onyphe.io
💥Detection method for #symlink #backdoor on #fortinet "we are willing to share it, privately" More than 18k devices compromised Read more: blog.onyphe.io/en/symlink-b...
Symlink backdoor on Fortinet SSL-VPN devices – Blog | Big Data for Cyber Defense
blog.onyphe.io
Time to search for a decentralized way to deal with vulnerability identifiers.
Guillaume Assier ⛅@guillaume.engineer · 2y agoPlus de CVE, plus de problèmes 😏 www.techzine.eu/news/securit...
And there's an #RStats package for it—now. codeberg.org/hrbrmstr/geo...
geolocus
geolocus R Package
codeberg.org
ONYPHE@onyphe.io · 2y ago❓Ever wanted to have an IP geolocation database with 2 locations, one physical for the device and one logical from whois data? 👉We provide a free MMDB file for download and a brand new Website for lookups & even a free API access: www.geolocus.io
❓Ever wanted to have an IP geolocation database with 2 locations, one physical for the device and one logical from whois data? 👉We provide a free MMDB file for download and a brand new Website for lookups & even a free API access: www.geolocus.io
Geolocus by ONYPHE
Geolocus is an IPv4 & IPv6 geolocation service. Our motto is: you don't need misleading GPS coordinates, you need trusted IP to country locations. Furthermore, an IP address truly has 2 locations: 1 l...
geolocus.io
👓La Cyber-revue à bas bruit est de retour ! L'alpha et l'oméga de cette édition : les zero days. C'est... surprenant 😇 Et aussi un podcast (coucou @nolimitsecu.bsky.social), des chiffres passionnants d' @onyphe.io et de La tech est politique et sa nouvelle rubrique. www.linkedin.com/pulse/zero-d...
Zero Day
Bonjour ☕ Bienvenue dans la Cyber-revue à bas bruit de la semaine. Je sais, ça fait un bail, mais : j'ai eu des semaines de ouf (dont une qui s'est finie avec votre dévouée bloquée à Bruxelles pour ca...
linkedin.com
The latest version of our cli tool has been released. Get v4.19.0 and find wrappers with sweet new APIs inside. Available here ➡️ search.onyphe.io/docs/onyphe-... or here 🐳 hub.docker.com/r/onyphe/ony... or even here 🥷 metacpan.org/dist/Onyphe
Installation | ONYPHE
Installation
search.onyphe.io
💥 Great news 💥 #ASD #AttackSurfaceDiscovery APIs are on their way to general availability. It will never be as easy to create an asset inventory for any organization attack surface #EASM Backed by 10th of billions of informations we collect.
📣 Meet Thomas Damonneville - our founder - at the #M3AAWG organized by the Messaging, Malware, Mobile Anti-Abuse Working Group in Lisbon next week for his presentation entitled: “Hunting for phishing URLs, kits and business”. 👋 In partnership with Signal Spam #phishing #phishingkit #cybersecurity
Yes, still 50k compromised devices. Since more than 12 months.
James Atack@jamesatack.bsky.social · 2y agoA thousand you say? In December 2024 you say? @insikt.bsky.social Is this not just badcandy again? because those telcos and universities have been owned for much longer than that via CVE-2023-20198. They just periodically have to recompromise them as they get rebooted. Also try 50k devices.
📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #PaloAltoNetworks PA product: CVE-2025-0108: authentication bypass on management interface search.onyphe.io/search?q=cat... Thanks to @assetnote.io for having shared the detection method.
Yet by performing an awkward legal waltz around the subject, Talos have helpfully supported my hypothesis that compromised IOS XE devices are part of an ORB network serving multiple APTs. archive.hack.lu/hack-lu-2024...
The XE Files - Trust No Router hack.lu 2024
On the 16th October 2023 Cisco Talos shared intelligence about a handful of compromised routers discovered while resolving customer support requests. As the full story unfolded, a handful of backdoore...
archive.hack.lu
