Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

URLx Just Got Bigger: 10.6B URLs for Recon and Malicious Infrastructure Hunting

hunt.io | blog | #wordpress | #threat-hunting | #dprk | #sql | #urlx | #data-platform

Summary

URLx expands to 10.6 billion URLs with richer SQL and domain-search filters; a walkthrough maps DPRK-linked compromised WordPress paths using API and SQL queries.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Threat Hunting at Scale: Explore 10.6B URLs to Find Payloads, C2s, and Exposed Assets with URLx
URLx offers 10.6 billion structured URLs, growing by a billion monthly; fields cover hostname, path, parameters, and file names for precise hunting via HuntSQL or API.
blog · hunt.io
Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities
This threat intelligence report documents active targeting of critical national infrastructure and defense contractors through edge application vulnerabilities.
blog · hunt.io
Unmasking SparkRAT: Detection & macOS Campaign Insights
Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
blog · hunt.io
‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces
Hunt.io resurfaces a suspected TA444/BlueNoroff cluster: a server hosting a fake 'JustJoin' macOS app landing page, plus two IPs sharing SSH keys pointing to coordinated DPRK-linked infrastructure.
blog · hunt.io
“Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure
Hunt.io traces new Kimsuky-suspected infrastructure reusing the distinctive 'Million OK!!!!' HTTP response and Naver branding, with domains on linked p-e.kr-style TLDs hosted in South Korea.
blog · hunt.io
Suspected DPRK Phishing Campaign Targets Naver; Separate Apple Domain Spoofing Cluster Identified
Hunt.io finds an exposed Naver phishing server—change/cookie/login panels and 200+ hosted domains—plus a separate cluster spoofing Apple domains with distinctive TLS certificates.
back