#censys — Public Fediverse posts

new writeup: the latest DarkSword operator, chinese-speaking, well over a hundred panels

found the whole thing off one http body hash. six panels, two totally different codebases, same guy

we're at 7-8 unrelated crews running this leaked ios chain now

https://censys.com/blog/darkswords-panel-sprawl/

#censys #darksword #threatintelligence

Whether you're trying to:
✓ Triage alerts
✓ Investigate incidents
✓ Hunt adversaries
✓ Defend against emerging campaigns

DNS is now another layer of the Censys Internet Map helping teams decide faster and more accurately across every stage of the security operations workflow: https://censys.com/blog/censys-expands-its-internet-map-to-include-dns-intelligence/

#Censys #infosec #ThreatIntel #DNS

Alex Gartner, #Censys Technical Product Lead, wrote a workbook for Data Protection teams covering five of these exposure scenarios, with queries you can run today.

Start here: https://censys.com/blog/dlp-blind-spot/ #infosec #dataprotection #DLP

A phishing email targeting a politician led to a much bigger discovery.

New research from Censys ARC researcher Martijn Grooten shows how Censys pivots uncovered additional UNC1151 infrastructure, exposing a broader credential theft campaign targeting Belarus and Ukraine.

Read more: https://censys.com/blog/unc1151-phishing-email-campaign/ #Censys #CensysARC #UNC1151 #Phishing

New infrastructure analysis from Censys reveals how the pro-Russian hacktivist group NoName057(16) maintains DDoSia operations through rapid server rotation. Monitoring since mid-2025 shows an average of 6 control servers active simultaneously, but with a mean lifespan of only 2.53 days.

#SecurityLand #ThreatHorizon #Research #Censys #DDoSia #DDoS #DDoSAttack #NoName057 #Ukraine #Russia #Hacktivism

Read More: https://www.security.land/ddosia-infrastructure-censys-research-noname057/

Is Your Android TV Streaming Box Part of a Botnet? https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/ #SuperMediaTechnologyCompanyLtd. #ElectronicFrontierFoundation #FederalBureauofInvestigation #InternetofThings(IoT) #HalfSpaceLabsLimited #BadBox2.0Enterprise #GrassOpCo(BVI)Ltd #LowerTribecaCorp. #ALittleSunshine #ARPpoisoning #WebFraud2.0 #RileyKilmer #WyndNetwork #SuperCaja #Synthient #Superbox #BestBuy #Tcpdump #Walmart #Amazon #Censys #IPidea #Netcat

Is Your Android TV Streaming Box Part of a Botnet?

https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/

#SuperMediaTechnologyCompanyLtd. #ElectronicFrontierFoundation #FederalBureauofInvestigation #InternetofThings(IoT) #HalfSpaceLabsLimited #BadBox2.0Enterprise #GrassOpCo(BVI)Ltd #LowerTribecaCorp. #ALittleSunshine #ARPpoisoning #WebFraud2.0 #RileyKilmer #WyndNetwork #SuperCaja #Synthient #Superbox #BestBuy #Tcpdump #Walmart #Amazon #Censys #IPidea #Netcat

What's up with #censys? First I block their scans in nginx.conf. They didn't get the message. I then add their published CIDRs to a ipfw drop table. So now they again tried from unpublished CIDRs -> added those to the drop table.

How Adversaries Exploit the Blind Spots in Your EASM Strategy https://hackread.com/how-adversaries-exploit-blind-spots-easm-strategy/ #Misconfiguration #Cloudsecurity #Cybersecurity #Security #Censys #Oracle #Shodan #EASM

Censys delivers internet intelligence to accelerate SOC triage and response https://www.helpnetsecurity.com/2025/10/28/censys-internet-intelligence-soc/ #Industrynews #Censys

Censys ICS/OT solution closes visibility gaps and secures exposed industrial systems https://www.helpnetsecurity.com/2025/10/17/censys-ics-ot-internet-intelligence/ #Industrynews #Censys

@brian_greenberg

I attempted to create a Censys query to help identify some victim devices. Just SNMP not Telnet.

Legacy Censys (search.censys.io)
services.software.vendor: /"Cisco"/ and (services.snmp.oid_system.name:"3750G" or services.snmp.oid_system.name:"9300" or services.snmp.oid_system.name:"9400")

V2 Censys (platform.censys.io)
(host.services.software.vendor=~"^\"Cisco\"$" or host.services.hardware.vendor=~"^\"Cisco\"$" or host.services.operating_systems.vendor=~"^\"Cisco\"$") and host.services.snmp.oid_system.name:{"3750G", "9300", "9400"}

#Censys #Cisco

300k+ Plex Media Server instances still vulnerable to attack via CVE-2025-34158 https://www.helpnetsecurity.com/2025/08/27/plex-media-server-cve-2025-34158-attack/ #PlexMediaServer #streamingdevice #securityupdate #vulnerability #Don'tmiss #Hotstuff #Censys #News

Hey, #Censys just released a new chrome extension
https://chromewebstore.google.com/detail/censys/cjcbocemonlaehhhpeaadmgakfofjlll

Write-up on our perspective at #Censys on ToolShell / CVE-2025-53770 exploit in SharePoint: https://censys.com/advisory/cve-2025-53770

Critical Wing FTP Server vulnerability exploited in the wild (CVE-2025-47812) https://www.helpnetsecurity.com/2025/07/11/critical-wing-ftp-server-vulnerability-exploited-in-the-wild-cve-2025-47812/ #vulnerability #WingFTPServer #filesharing #RCESecurity #Don'tmiss #Hotstuff #Huntress #exploit #Censys #News #SMBs #MSP #PoC

CitrixBleed 2 might be actively exploited (CVE-2025-5777) https://www.helpnetsecurity.com/2025/06/30/citrixbleed-2-might-be-actively-exploited-cve-2025-5777/ #vulnerability #enterprise #ReliaQuest #Don'tmiss #NetScaler #Hotstuff #Censys #Citrix #News

🔌 Iran Internet Outage Update
Since June 18, Iran has faced a near-total internet blackout. June 21 marked the lowest point in visibility—but signs of recovery are emerging.

📉 Some networks (e.g., DATAK, HAMYAR-AS) remain unstable.
📈 Others (e.g., RESPINA-AS, MOBINNET-AS) are bouncing back strong.
🧭 TIC appears in nearly all slow-recovering transit paths.

We’re tracking it all.
🔍 View the update at Censys: https://censys.com/blog/irans-internet-a-censys-perspective

#InternetShutdown #Iran #NetworkOutage #Censys #InternetIntelligence

Сравнительный обзор: Shodan, ZoomEye, Netlas, Censys, FOFA и Criminal IP. Часть 2

Во второй части сравнительного обзора продолжается анализ ведущих интернет-сканеров и OSINT-платформ. На этот раз внимание сосредоточено на Censys и FOFA — двух мощных инструментах, каждый из которых предлагает уникальные подходы к сбору и структурированию данных об открытых сервисах в интернете. В статье рассматриваются архитектура платформ, синтаксис запросов, охват портов, возможности поиска по сертификатам и телу веб-страниц, а также примеры реального применения.

https://habr.com/ru/companies/securityvison/articles/917464/

#osint #osint_tools #osint_сервисы #censys

Misconfigured HMIs Expose US Water Systems to Anyone with a Browser https://www.securityweek.com/misconfigured-hmis-expose-us-water-systems-to-anyone-with-a-browser/ #Identity&Access #ICS/OT #Censys #SCADA #Water #HMI #ICS

Misconfigured HMIs Expose US Water Systems to Anyone with a Browser https://www.securityweek.com/misconfigured-hmis-expose-us-water-systems-to-anyone-with-a-browser/ #Identity&Access #ICS/OT #Censys #SCADA #Water #HMI #ICS

Сравнительный обзор: Shodan, ZoomEye, Netlas, Censys, FOFA и Criminal IP

В современном интернете всё, что подключено к сети, может быть найдено — было бы желание и подходящий инструмент. Сканеры вроде Shodan, ZoomEye, Netlas, Censys, FOFA и Criminal IP давно вышли за рамки «поисковиков для хакеров» и стали рабочими лошадками для специалистов по кибербезопасности, Red Team, SOC-аналитиков и OSINT-энтузиастов. Они позволяют буквально заглянуть в «техническое подбрюшье» интернета: найти уязвимые камеры, забытые базы данных, тестовые серверы без авторизации и промышленное оборудование, случайно выставленное наружу. В этой статье приводится сравнение шести наиболее популярных и полезных поисковых систем открытых хостов. Рассматриваются особенности архитектуры, синтаксис запросов, доступность функций, а также возможности каждой платформы — включая API, интеграции с другими решениями, систему алертов, поиск по сертификатам, изображениями и т.д. Отдельное внимание уделено примерам практического применения и оценке релевантности данных. Это первая часть серии, посвящённой сравнительному обзору. В ней подробно рассматриваются возможности Shodan и ZoomEye. В следующих частях будет проведён анализ Censys, FOFA, Netlas и Criminal IP.

https://habr.com/ru/companies/securityvison/articles/913832/

#shodan #osint #zoomeye #censys

RCE flaw in tool for building AI agents exploited by attackers (CVE-2025-3248) https://www.helpnetsecurity.com/2025/05/06/langflow-cve-2025-3248-exploited/ #vulnerability #Horizon3ai #Don'tmiss #Hotstuff #exploit #SANSISC #Censys #News #PoC

Censys enables security teams to be more proactive in their threat hunting https://www.helpnetsecurity.com/2025/04/28/censys-threat-hunting/ #Industrynews #RSAC2025 #Censys

自インスタンスの #sshログ を検査したら、また、 #Censys, Inc. が不正ポートスキャン。１回。

止めろ！！止めろ！！

#prattohome

A quick reminder to inspect what you expect, especially when #selfhosting.

#selfhosted #security #audit #censys

Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891) https://www.helpnetsecurity.com/2025/01/29/zyxel-cpe-devices-under-attack-vulnerability-cve-2024-40891/ #vulnerability #Don'tmiss #GreyNoise #VulnCheck #Hotstuff #Censys #Zyxel #News