ONYPHE

For personal use I added a "geolocus" tool to a Deno-based MCP server (that has alot of random tools/functions in it).

It's been useful enough that I started extracting it to a standalone geolocus MCP server I shld be able to release in a couple days.

The @onyphe.io folks are super rad.

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #Ivanti product:

CVE-2025-4427+CVE-2025-4428 unauth RCE

search.onyphe.io/search?q=cat...

Thanks to watchTowr for detection method.

The image shows a block of structured JSON data displayed on a dark background. The JSON object has the following top-level structure: • abuse: A list of four email addresses related to reporting abuse at Amazon and AWS: • amzn-noc-contact@amazon.com • aws-routing-poc@amazon.com • aws-rpki-routing-poc@amazon.com • trustandsafety@support.aws.com • asn: "AS14618" (This is Amazon’s autonomous system number.) • continent: "NA" (North America) • continentname: "North America" • country: "US" (United States) • countryname: "United States" • domain: A list of three domains: • amazon.com • amazonaws.com • aws.com • ip: "3.215.138.152" (The specific IP address being described.) • isineu: 0 (Indicates whether the IP is in the European Union — 0 means no.) • latitude: "37.09024" • longitude: "-95.712891" • location: "37.09024, -95.712891" • netname: "AMAZON-IAD" (The name of the network.) • organization: "Amazon Data Services NoVa" • physical_asn: "AS14618" • physical_continent: "NA" • physical_continentname: "North America" • physical_country: "US" • physical_countryname: "United States" • physical_isineu: 0 • physical_latitude: "37.09024" • physical_longitude: "-95.712891" • physical_location: "37.09024, -95.712891" • physical_organization: "Amazon.com, Inc." • physical_subnet: "3.208.0.0/12" • physical_timezone: "America/Chicago" • subnet: "3.208.0.0/12" • timezone: "America/Chicago"

Usage # Download the latest Geolocus database geolocus-cli download # Look up IPs from a file geolocus-cli lookup -i ips.txt -o results.json # Process IPs from stdin and output to stdout cat ips.txt | geolocus-cli lookup # Output in CSV format geolocus-cli lookup -i ips.txt -f csv -o results.csv # Output in JSONL format (one JSON object per line) geolocus-cli lookup -i ips.txt -f jsonl -o results.jsonl # Disable session caching geolocus-cli lookup -i ips.txt --no-cache Command-line Options Commands: download Download a fresh copy of the geolocus.mmdb database lookup Lookup and enrich IP addresses from a file or stdin Options: -h, --help Show help information -i, --input <file> Input file containing IP addresses (one per line) -o, --output <file> Output file for results (defaults to stdout) -f, --format <format> Output format: json, csv, or jsonl (default: json) --no-cache Disable IP caching for the current session

ONYPHE has a super cool geolocus MMDB — https://www.geolocus.io/ — that gets updated daily and has network-level metadata for IP addresses (ref first image JSON).

Since it's way more efficient to use this than their API, I built a cross-platform CLI tool for […]

[Original post on mastodon.social]

New geolocus-cli For ONYPHE’s Geolocus Database

ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of: { "abuse": [ "amzn-noc-contact@amazon.com", "aws-routing-poc@amazon.com", "aws-rpki-routing…

#hackernews #news

The recovery continues, but things are not yet back to normal

Things are not yet getting better in Spain and Portugal. General downward trend and some visible instability in the remaining networks that are reachable.

#PowerOutage

A chart showing Internet scan data plots for three countries; Spain, Portugal and France. The three lines are stable, with minor variations from 09:00 to 12:30. At 12:30 the lines for Spain and Portugal drop almost vertically to roughly 50% of their original levels. The line for France continues as for the start of the day. The lines for Spain and Portugal have not returned to their original levels.

The electrical power outage in Spain and Portugal as seen from the Internet (France included for reference)

ERRATUM: the CVSS was given, it is a 9.8

#CVE-2025-32432 #0day #CraftCMS discovered by Orange Cyberdefense

💥Unauthenticated Remote Code Execution. No CVSS yet, we suggest to give it a 10

📌40,000 IP addresses representing over 37,000 domain names exposed, 12,168 unique domains vulnerable

Blog:

blog.onyphe.io/en/cve-2025-...

UPDATE: our scan has finished, near 22,000 devices are compromised.

💥Méthode de détection de la #backdoor #symlink sur #fortinet

"nous sommes prêts à la partager, en privé"

Plus de 18,000 équipements compromis

Lire l'article : blog.onyphe.io/backdoor-sym...

💥Detection method for #symlink #backdoor on #fortinet

"we are willing to share it, privately"

More than 18k devices compromised

Read more: blog.onyphe.io/en/symlink-b...

Time to search for a decentralized way to deal with vulnerability identifiers.

You're nice to us, thank you for saying we are honorable ☺️

Many thanks :)

And there's an #RStats package for it—now.

codeberg.org/hrbrmstr/geo...

Geolocus by ONYPHE Geolocus is an IPv4 & IPv6 geolocation service. Our motto is: you don't need misleading GPS coordinates, you need trusted IP to country locations. Furthermore, an IP address truly has 2 locations: 1 l...

❓Ever wanted to have an IP geolocation database with 2 locations, one physical for the device and one logical from whois data?

👉We provide a free MMDB file for download and a brand new Website for lookups & even a free API access:

www.geolocus.io

Zero Day Bonjour ☕ Bienvenue dans la Cyber-revue à bas bruit de la semaine. Je sais, ça fait un bail, mais : j'ai eu des semaines de ouf (dont une qui s'est finie avec votre dévouée bloquée à Bruxelles pour ca...

👓La Cyber-revue à bas bruit est de retour ! L'alpha et l'oméga de cette édition : les zero days. C'est... surprenant 😇

Et aussi un podcast (coucou @nolimitsecu.bsky.social), des chiffres passionnants d' @onyphe.io et de La tech est politique et sa nouvelle rubrique.
www.linkedin.com/pulse/zero-d...

The latest version of our cli tool has been released. Get v4.19.0 and find wrappers with sweet new APIs inside.

Available here ➡️
search.onyphe.io/docs/onyphe-...

or here 🐳 hub.docker.com/r/onyphe/ony...

or even here 🥷 metacpan.org/dist/Onyphe

💥 Great news 💥

#ASD #AttackSurfaceDiscovery APIs are on their way to general availability.

It will never be as easy to create an asset inventory for any organization attack surface #EASM

Backed by 10th of billions of informations we collect.

📣 Meet Thomas Damonneville - our founder - at the #M3AAWG organized by the Messaging, Malware, Mobile Anti-Abuse Working Group in Lisbon next week for his presentation entitled: “Hunting for phishing URLs, kits and business”.

👋 In partnership with Signal Spam

#phishing #phishingkit #cybersecurity

Yes, still 50k compromised devices. Since more than 12 months.

📣 We have added a new #vulnerability detection to our #ASM #AttackSurfaceManagement solution for #PaloAltoNetworks PA product:

CVE-2025-0108: authentication bypass on management interface

search.onyphe.io/search?q=cat...

Thanks to @assetnote.io for having shared the detection method.

The XE Files - Trust No Router hack.lu 2024 On the 16th October 2023 Cisco Talos shared intelligence about a handful of compromised routers discovered while resolving customer support requests. As the full story unfolded, a handful of backdoore...

Yet by performing an awkward legal waltz around the subject, Talos have helpfully supported my hypothesis that compromised IOS XE devices are part of an ORB network serving multiple APTs.

archive.hack.lu/hack-lu-2024...

🎉 Retrospective 2024 and Roadmap 2025

👉 Over the last 12 months, we massively increased our visibility of Internet exposed assets. Until now, we focused on #ASM, but this year we will improve our automatic #ASD and expand into the #CTI segment.

Read more: search.onyphe.io/docs/write-u...

onyphe ctiscan result showing the number of rpc protocol exposed on Windows boxes, that is 2193060 found in 0.26 seconds

we tag it at a risky protocol

there are 2.2M results for Windows RPC boxes

Cc @greynoise.infosec.exchange.ap.brid.gy

Thanks, will do ☺️

And for the previous report, written in 2022:

www.greynoise.io/blog/new-sen...

Many thanks to @hrbrmstr.dev on X for this study.

🏁 Our main competitor, The Leading Internet Intelligence Platform for Threat Hunting and Attack Surface Management, can count on us to be their biggest challenger.

#AttackSurfaceManagement #ASM #CyberThreatIntelligence #CTI

Read the complete report here:

www.greynoise.io/blog/checkin...