🚨 Launch Alert: The Censys Threat Hunting Module is here. Proactively track adversaries, pivot across malicious infrastructure, scan in real time, and hunt faster — with the most complete view of Internet threats available today. See more: censys.com/solutions/thre… #threathunting
Censys
2,469 posts
Censys is the source for real-time Internet intelligence and actionable threat insights for governments, F500 companies, and leading threat intel providers
- Regarding the recent #Polyfill supply chain attack: despite the domain being down, we've identified nearly half a million hosts still referencing the polyfill[.]io endpoint -- incl. major entities in streaming, auto, and entertainment, along with ~260 hosts tied to gov domains.
- 🚨 CVE-2025-54309 (CVSS 9.8): Critical CrushFTP #CVE202554309 Unauth RCE → Admin access via HTTPS when DMZ proxy is off. ⚠️CrushFTP10 <10.8.5 & 11 <11.3.4_23 affected. ❗Exploitation confirmed 🔎 55K+ interfaces exposed 🛡️ Patch now 🔗 hubs.ly/Q03y_N340 👇Exposure Map
- 🚨 Malware infra is volatile. ~50% of Cobalt Strike servers vanish in 5 days. ~40% of Viper hides on port 60000. 🔎 Data freshness = critical. If you’re not tracking, you’re missing it. Latest from Censys → 🔗 hubs.ly/Q03BNq5F0 #ThreatIntelligence #SOTIR #MalwareAnalysis
- Censys is rolling out a new label for identifying Cisco IOS XE WebUI services in response to CVE-2023-20198 ("labels=cisco-xe-webui") Initial analysis: 34,140 hosts have indicators of compromise. Full report coming soon... search.censys.io/search?resourc…
- 🎉 Censys Free users, great news — your account just got an upgrade! With your Free account, you now have access to three additional productivity-boosting features: 🚀 Collections: Continuously monitor a specific set of assets based on a search query you define. ⚙️ Lookup
GIF - 🔴 CVE-2025-53770 (CVSS 9.8): Critical SharePoint RCE actively exploited as part of #ToolShell 👀 9,762 hosts online (Censys): hubs.ly/Q03y6BW80 🔎@GreyNoiseIO flagged + Censys scans show RDP TCP/3389 using “alikullab1” untrusted cert #CVE202553770 #SharePoint
- Check out these queries from @embee_research in the Censys Community about hunting Astaroth malware domains - super helpful stuff! community.censys.com/search-finding…
- 🚨 Active Exploitation of Cisco ISE RCE Vulnerability (CVE-2025-20337) 🚨 A critical unauthenticated RCE flaw in Cisco ISE and ISE-PIC is now being exploited. Amazon researchers observed an APT targeting a previously undocumented ISE endpoint. 🔴 Affects ISE/ISE-PIC versions
- 📊 Live dashboard tracking #TellYouThePass ransomware infections actively exploiting #PHP hosts vulnerable to CVE-2024-4577: lookerstudio.google.com/s/mhnJviXMP4I. As of June 11, we’ve detected ~1,700 public-facing infected hosts online.
- The 🆕 Censys Threat Hunting module helps find threats faster. ✔️See host attribute uniqueness instantly ✔️Auto-pivot into rare indicators ✔️Trace related infrastructure in minutes Our research team hows via APIs (w/code snippets): hubs.ly/Q03CGKkM0 #ThreatHunting
- A defining moment for @censysio - We are excited to announce that the Threat Hunting Module in the new Censys Platform is now #GA! censys.com/blog/internet-…
- Tracking ❄️PolarEdge → Residential Proxy #Botnets & ORBs • Preferred by 🇨🇳 actors • Targets Cisco, ASUS, NAS, #SOHO gear • Mbed TLS backdoor on high ports • 150 → 40k infected since 2023 • Hotspots: 🇰🇷 51.6% | 🇺🇸 21.1% Details + detection: hubs.ly/Q03CMCr_0
- If you think Salt Typhoon has moved on—you might want to double-check your attack surface. We’re still seeing critical telecom infrastructure exposed to active targeting. Find out what we uncovered (and what you should be looking for)














