Stay ahead with updates on high-profile vulnerabilities, expert tutorials, essential safety tips, and the latest Netlas developments.

Joined November 2020
Replying to @RESecurity
@RESecurity sponsors HI Cyber Con 2026 is officially announced. 🌐 🎙️ 3-day conference - 12 speakers 🚩 48-hour international CTF 🏆 $2,500 prize pool 📅 30 Oct – 1 Nov 2026 Organized by Hidden Investigations Organizing Partner: @WUSTEDU #HICyberCon2026
1
1
113
Yesterday, during some free time, I dove into Netlas.io to hunt for malicious URLs and IPs. Using query like http.body (to search based on keywords, text string, filename, or any possible things in the HTML body) and http.favicon.hash_sha256 (to search for favicon hashes, I uncovered a network of phishing sites targeting Telegram accounts. Based on a reported phishing link from a victim, I crafted this query: http.body:("Telegram is a cloud-based") and http.favicon.hash_sha256:"504b4621e486970f8c1721d5297561c9f33296f516c83fbb33a0ff3f4f7c1357" This led me to a C2 Panel linked to a Russian threat actor actively phishing Telegram accounts across multiple countries—spanning South Africa to Russia. I encountered phishing source codes on the dark web, utilizing reverse proxies and live-panel phishing techniques. Some source codes had comments written in Chinese, while others had Russian comments, showcasing completely different coding bases. Using tools like Netlas and leveraging HTML body, IOCs, keywords, favicon hashes, and even Google Analytics IDs, can dramatically enhance your ability to uncover malicious networks. Additional tips for threat hunting: Apply creative skills to identify patterns and connections. Explore the usage query guidelines from Netlas to unlock advanced query techniques. Combine efforts with tools like URLscan, Shodan, ZoomEye, FOFA, and Hunter[.]how for deeper insights into related malicious websites. Have more ideas or insights on threat hunting? Share them in the comments — I’d love to hear from you! Disclaimer: This is my personal analysis conducted in my free time and does not represent the views or opinions of my employer. Merry Christmas to All 🎄 #netlas Netlas.io #cybersecurity #threathunting #phishing #telegram #threatintel #cybercrime #russian #hacker #chinese
1
2
13
1,147
RCE in the wild 9M targets are vulnerable 1% can be successful for exploitation (Still Huge Number), I only post 0days on my YT. youtu.be/W9TVK_lfu_c?si=iboA… Using @Netlas_io things are easy to discover, Fix your assets with it or use it for #bugbounty #rce #0day #phpcgi #apache
2
2
515
Sharing my experience with @Netlas_io:🕵️‍♂️ I've integrated Netlas.io into my automation framework to retrieve asset IPs, subdomains, and associated domains. it has led me to discover numerous new assets, facilitating successful subdomain takeovers and Identifying additional security issues along the way. Additionally, I've been using Netlas.io for identifying vulnerable services using keywords, titles, or favicon hashes, a strategy that has yielded significant success. Here's how you can leverage some of these services Scenario 1: If you've identified a service vulnerable to a specific issue and wish to identify other affected targets, Netlas.io allows you to search for similar targets using keywords found in the response body. For example, by searching for the keyword "hubspot" in the response body, you can uncover all targets sharing this characteristic. Example: https://app[.]netlas[.]io/responses/?q=http.body:(hubspot)&page=1&indices= Scenario 2: In the event of a new 0-day exploit circulating, and you're in search of specific instances like Jenkins based on request headers, Netlas.io provides the means to quickly pinpoint such instances. Example: https://app[.]netlas[.]io/responses/?q=http.headers.x_jenkins:* OR http.headers.x_jenkins_cli2_port:* OR http.headers.x_jenkins_session:*&page=1 Scenario 3: Need to locate subdomains efficiently? You can use something like Example: https://app[.]netlas[.]io/domains/?indices=&page=1&q=domain%3A%28domain%3A%2A.paypal[.]com%29 Scenario 4: For broad investigations aimed at finding domains associated with a specific registrant org name or email or nameservers, you could use something like Example: https://app[.]netlas[.]io/whois/domains/?indices=&page=1&q=registrant.organization:"GRABTAXI HOLDINGS PTE. LTD" These are just a few examples of the features that I use at the moment. While most features require a paid subscription, the potential payoff in identifying critical issues for me specifically using Netlas has been worthwhile investment. While free sources of information exist, each service possesses its own dataset, and records can vary significantly. For my purposes, I've found Netlas.io to be the most cost-effective and reliable option. My opinion is that as long as the product helps pay itself off, I think It's definitely worth adding It to your toolkit.
5
51
316
28,157
After 4 months of procrastination, I finally wrote an article on Medium about gathering info about usernames: - basics tools for nickname enumeration - search URLs with nickname - using ip search engines (@shodanhq @Netlas_io) for nickname info gathering medium.com/@cyb_detective/wh…
11
90
4
265
65,811
Did you notice share button appeared in @Netlas_io Attack Surface Discovery tool? Here is OKX.com attack surface as they published on @Hacker0x01 for example: nt.ls/63dRu hackerone.com/okx #cybersecurity #hacking #bugbountytips
3
10
1,620
after looking for @Netlas_io i can say its completely awesome....
1
7
80
11,371
Today I tested @Netlas_io (since I needed a replacement for @securitytrails). Its worth the money - some of you know I am heavily into automation, data quality is important. When it comes to price/performance ratio - Netlas is currently the way to go.
2
3
38
10,003
CVE-2023-28771 looks interesting 🧐 Hm. If the search really is just one favicon, then @Netlas_io is able to give a little more results: nt.ls/1JrMm I'll have to study it in more detail...
1
4
12
2,495
Been trying out @Netlas_io for a while and the results and filters on this are amazing! There's a lot of experimentation one can do with this. Surely underrated! #infosec #BugBounty #bugbountytips
8
7
59
6,684
With greater certainty, the best filters with the best recons! Thank you @Netlas_io + @pdnuclei you are the best! I recommend everyone buy!! app.netlas.io/ref/451d8b27/ #bugbountytips #bugbounty
6
77
1
330
35,330
I recently started using @Netlas_io , I'm really enjoying the tool, it's fast, and it brings fascinating things! #bugbounty #bugbountytips
2
19
93
12,043
Recently I’ve seen a lot of posts about PaperCut NG/MF RCE vulnerabilities CVE-2023-27350 and CVE-2023-27351. Most of them are used internally. And yet there are 1,1K instances exposed to the Internet. 👉🏼 Netlas.io search: nt.ls/ZGjrR #RCE #infosec
1
2
3
1,083
"If you sit on the river bank for a long time, you can see how the sessionId of the administrator floats by", (c) Sun Tzu. CVE-2023-22620 requires a patience from a hacker because he needs to wait until the admin enters the session. Search at @Netlas_io: nt.ls/k9W35
2
2
703
I love XSS, but I bad in working with them... So, I can write about it! Look at a vuln which has been discovered in the BNE Testimonials plugin for WordPress. Yes, it allows to make stored XSS injection. You can see vulnerable sites at @Netlas_io: nt.ls/0rocc
CVE-2023-24411 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kerry Kline BNE Testimonials plugin <= 2.0.7 versions. cve.mitre.org/cgi-bin/cvenam…
1
2
479
Adobe ColdFusion 2018 and 2021 affected to critical CVE-2023-26359 and CVE-2023-26360. Arbitrary code execution exploited in the wild ☝️🚨⚠️ Netlas.io gives about 180K instances: 👉🏼 Search: nt.ls/adbcf 👉🏼 Details: attackerkb.com/topics/1iRdvt… #infosec #RCE
2
3
10
1,336
IBM Aspera Faspex pre-authentication YAML deserialization vulnerability in Ruby on Rails code. CVE-2022-47986 has CVSS score of 9.8 🚨⚠️ rapid7.com/blog/post/2023/03… How to search on Netlas.io: 👉🏼 app.netlas.io/responses/?q=h… #cybercesurity #hacking #netlas
1
2
336