For personal use I added a "geolocus" tool to a Deno-based MCP server (that has alot of random tools/functions in it). It's been useful enough that I started extracting it to a standalone geolocus MCP server I shld be able to release in a couple days. The @onyphe.io folks are super rad.

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #Ivanti product: CVE-2025-4427+CVE-2025-4428 unauth RCE search.onyphe.io/search?q=cat... Thanks to watchTowr for detection method.

ONYPHE has a super cool geolocus MMDB — https://www.geolocus.io/ — that gets updated daily and has network-level metadata for IP addresses (ref first image JSON). Since it's way more efficient to use this than their API, I built a cross-platform CLI tool for […] [Original post on mastodon.social]

New geolocus-cli For ONYPHE’s Geolocus Database ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "[email protected]", "[email protected]", "aws-rpki-routing… #hackernews #news

The recovery continues, but things are not yet back to normal

Things are not yet getting better in Spain and Portugal. General downward trend and some visible instability in the remaining networks that are reachable. #PowerOutage

The electrical power outage in Spain and Portugal as seen from the Internet (France included for reference)

#CVE-2025-32432 #0day #CraftCMS discovered by Orange Cyberdefense 💥Unauthenticated Remote Code Execution. No CVSS yet, we suggest to give it a 10 📌40,000 IP addresses representing over 37,000 domain names exposed, 12,168 unique domains vulnerable Blog: blog.onyphe.io/en/cve-2025-...

UPDATE: our scan has finished, near 22,000 devices are compromised.

💥Méthode de détection de la #backdoor #symlink sur #fortinet "nous sommes prêts à la partager, en privé" Plus de 18,000 équipements compromis Lire l'article : blog.onyphe.io/backdoor-sym...

💥Detection method for #symlink #backdoor on #fortinet "we are willing to share it, privately" More than 18k devices compromised Read more: blog.onyphe.io/en/symlink-b...

Time to search for a decentralized way to deal with vulnerability identifiers.

And there's an #RStats package for it—now. codeberg.org/hrbrmstr/geo...

❓Ever wanted to have an IP geolocation database with 2 locations, one physical for the device and one logical from whois data? 👉We provide a free MMDB file for download and a brand new Website for lookups & even a free API access: www.geolocus.io

👓La Cyber-revue à bas bruit est de retour ! L'alpha et l'oméga de cette édition : les zero days. C'est... surprenant 😇 Et aussi un podcast (coucou @nolimitsecu.bsky.social), des chiffres passionnants d' @onyphe.io et de La tech est politique et sa nouvelle rubrique. www.linkedin.com/pulse/zero-d...

The latest version of our cli tool has been released. Get v4.19.0 and find wrappers with sweet new APIs inside. Available here ➡️ search.onyphe.io/docs/onyphe-... or here 🐳 hub.docker.com/r/onyphe/ony... or even here 🥷 metacpan.org/dist/Onyphe

💥 Great news 💥 #ASD #AttackSurfaceDiscovery APIs are on their way to general availability. It will never be as easy to create an asset inventory for any organization attack surface #EASM Backed by 10th of billions of informations we collect.

📣 Meet Thomas Damonneville - our founder - at the #M3AAWG organized by the Messaging, Malware, Mobile Anti-Abuse Working Group in Lisbon next week for his presentation entitled: “Hunting for phishing URLs, kits and business”. 👋 In partnership with Signal Spam #phishing #phishingkit #cybersecurity

Yes, still 50k compromised devices. Since more than 12 months.

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #PaloAltoNetworks PA product: CVE-2025-0108: authentication bypass on management interface search.onyphe.io/search?q=cat... Thanks to @assetnote.io for having shared the detection method.

Yet by performing an awkward legal waltz around the subject, Talos have helpfully supported my hypothesis that compromised IOS XE devices are part of an ORB network serving multiple APTs. archive.hack.lu/hack-lu-2024...

🎉 Retrospective 2024 and Roadmap 2025 👉 Over the last 12 months, we massively increased our visibility of Internet exposed assets. Until now, we focused on #ASM, but this year we will improve our automatic #ASD and expand into the #CTI segment. Read more: search.onyphe.io/docs/write-u...

we tag it at a risky protocol there are 2.2M results for Windows RPC boxes

Cc @greynoise.infosec.exchange.ap.brid.gy

🪘 That's probably the best advertisement we may have: an independent benchmark from GreyNoise Intelligence about benign Internet scanning activity. It shows our #scanning technology can give you a better view on your exposed assets that cyber-criminals.

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #Fortinet FortiGate product: CVE-2024-55591: unauthenticated remote issue allows to gain super-admin privileges search.onyphe.io/search?q=cat... Thanks to @WatchTowr for sharing detection method.

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #SimpleHelp SimpleHelp product: CVE-2024-57727: sensitive information disclosure caused by path traversal vulnerability search.onyphe.io/search?q=cat...

Just starting to scan #IPv6 at application layer and already found a compromised device running a #MeshCentral #C2 #Panel

Just starting to scan #IPv6 at application layer and already found a compromised device running a #MeshCentral #C2 #Panel

Couple of additional datapoints about the "Trojan Panel" C2 that \@shanholo had already found in April i) the github followers list is an eye-opener ii) Oracle the leading public cloud for once details below 👇

I'm going to stop there for now for biological reasons If anyone is interested, our data supports the hypothesis that UAC-0050, targeting the Ukranian government, is exploiting DCE/RPC on Windows boxes to establish C2 capability for the duration of a campaign.

Looking at the first C2 IP 111[.]90.140.76 with @onyphe.bsky.social (yeah well...) nothing currently up but looking back in historical data we've got an RDP box with dcerpc also exposed going back to Sep 24

The Great #Honeypot of China in one picture:

Mais que montrent les données de @onyphe.bsky.social ? Un système Citrix Gateway qui semble, un temps, ne pas avoir répondu à ses sondes 🤔

Si vous cherchez une école du 21ème siècle à Paris 👇

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #Mitel MiCollab product: CVE-2024-35286: unauthenticated SQL injection on login page CVE-2024-41713: unauthenticated arbitrary file read www.onyphe.io/search?q=cat...

Hi there \o/

@onyphe.bsky.social identifies more than 2k vulnerable IPs. That could mean all of them are compromised :/

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #PaloAltoNetworks PA product: CVE-2024-0012: authentication bypass on mgmt interface CVE-2024-9474: authenticated (bypassed) RCE on mgmt interface www.onyphe.io/search?q=cat...

And guess what! SonicWall again according to data from @onyphe.bsky.social 😉 #Akira

Oh gosh, one of the recently claimed #Akira victims ticked all the boxes with an outdated Exchange server and a SonicWall VPN, right end of August 🤯 (data courtesy of @onyphe.bsky.social)

Has #Termite been active for longer than just a month or so? Data from @onyphe.bsky.social suggests that strongly. Culligan uses a Fortinet VPN server. It was non responding from April 20th to July 3rd. It should been scanned ~April 26th. I assessed the attack happened around that time.

Another day, another vuln. #JetBrains #TeamCity suffers from a critical unauth remote code execution flaw. 600+ unique IP vulnerable. #CVE_2024_23917 #CVE202423917 #asm #iav #asd #attacksurfacemanagement

"The Military Intelligence and Security Service (MIVD) has been compromised by Chinese Hackers" #fortigate #CVE202242475 #CVE_2022_42475 was the initial access vector. #iav #asm #attacksurfacemanagement #attacksurface www.ncsc.nl/actueel/nieu...

"Data Breach Notifications" #citrixbleed #CVE20234966 #CVE_2023_4966 #citrix is exploited by threat actors. #iav #asm #attacksurfacemanagement #attacksurface Still ~1.9K vulnerable IPs. apps.web.maine.gov/online/aevie...

"Urgent warning: a targeted phishing campaign impersonating the F5 company" #CVE202346747 #CVE_2023_46747 #F5 IS NOT exploited in this attack. It is a phishing campaign pretending to provide a patch against this vuln. The patch is a wiper, don't deploy it. Source: www.gov.il/he/Departmen...

"#StopRansomware: Play Ransomware" #CVE201813379 #CVE_2018_13379 #fortinet is exploited by threat actors. #CVE202241040 #CVE_2022_41040 #proxynotshell is exploited by threat actors. #iav #asm #attacksurfacemanagement #attacksurface Source: www.cisa.gov/news-events/...

"Imperva Detects Undocumented 8220 Gang Activities" #CVE202014882 #CVE_2020_14882 #oracle #weblogic is exploited by threat actors. Still 86 unique vulnerable IPs exposed. #iav #asm #attacksurfacemanagement #attacksurface Source: www.imperva.com/blog/imperva...

"LockBit 3.0 #Ransomware Affiliates #Exploit #CVE-2023-4966 Citrix Bleed Vulnerability" #CVE20234966 #CVE_2023_4966 #citrixbleed is exploited by threat actors. Still 2.1K unique vulnerable IPs exposed. #iav #asm #attacksurfacemanagement #attacksurface Source: www.cisa.gov/news-events/...

"Russian Foreign Intelligence Service (SVR) Exploiting #JetBrains #TeamCity #CVE Globally" #CVE-2023-42793 #CVE202342793 is exploited by threat actors. Still 800 unique vulnerable IPs exposed. #iav #asm #attacksurfacemanagement Source: www.cisa.gov/news-events/...