OPEN FINDINGS
—
From connected data store
SECURITY WORKSPACE / OVERVIEW
Threat intelligence overview
A consolidated view of public intelligence signals relevant to your organisation.
CONNECTING
CN
YOUR SECURITY HEALTH
Health score
Loading your score…
WHAT TO DO NEXT
Fix these first
Open an item for plain-language steps, how long it takes, and a ready-made message you can send to your IT person.
WHAT NEEDS ATTENTION
Your threats
Loading…
Loading…
CRITICAL / HIGH
—
Requires prioritised review
MONITORED ASSETS
—
Domains and other declared assets
CATEGORIES REPORTING
—
Of 11 monitoring categories
MONITORING RUN
Run a scan
Checks all eleven categories against public sources and your own website, and records what each source could and could not tell us.
A scan loads your own home page the way a visitor's browser does (to check HTTPS, security headers and the software it advertises), asks for around 80 well-known pages and files, such as backup and admin pages, to see whether they are publicly readable (a few at a time, with short pauses), and reads public DNS, Certificate Transparency, abuse.ch, CISA, NIST, FIRST, endoflife.date, Have I Been Pwned's public breach list and RansomLook. It never logs in, exploits anything or scans ports.
HOSTNAMES CHECKED
—
HOSTNAMES RESOLVING
—
NEW ASSETS ADDED
—
NEW FINDINGS
—
REQUESTS USED
—
LATEST SCAN
No scan recorded yet.
Results are indicative, not exhaustive. A discovered hostname is not proof of ownership, and a finding is not proof of compromise. Verify before acting.
SECURITY WORKSPACE / COVERAGE
Coverage
What is actually being checked, and what could not be read this time.
COVERAGE
CN
WHAT IS ACTUALLY BEING CHECKED
Monitoring coverage
Loading coverage…
SECURITY WORKSPACE / THREAT FINDINGS
Threat findings
Everything we found, with plain steps for each one. Every finding is a lead to verify, not a confirmed incident.
FINDINGS
CN
INTELLIGENCE FEED
Findings
| FINDING | CATEGORY | SEVERITY | CONFIDENCE | DETECTED | STATUS | |
|---|---|---|---|---|---|---|
| Connecting to the API… | ||||||
SECURITY WORKSPACE / ASSETS & SUPPLIERS
Assets and suppliers
The domains, brands and suppliers Cybernocs watches for you.
ASSETS
CN
EXTERNAL FOOTPRINT
Monitored assets
Brands drive look-alike and ransomware matching, and IP ranges are compared with botnet command-and-control lists. Cybernocs only checks what can be seen from the internet, so the software list below is read from your website and cannot be typed in. Domains need to be proven in Settings before they are scanned.
Only add domains, email domains, brands, IP addresses and ranges that you own or have written permission to have checked. If you add something you are not entitled to, you are responsible for it under the terms of service.
Software seen on your website
Loading…
Loading assets…
SUPPLY CHAIN
Suppliers
Each supplier is checked against ransomware leak-site listings and the public breach list. Add the supplier's domain to also check its addresses against botnet lists.
Common suppliers — click to fill in the form, then check the name and add:
Loading suppliers…
WORKSPACE / CONFIGURATION
Settings
Configure your organisation and monitoring preferences.
CONFIGURATION
CN
SECURITY WORKSPACE / SCAN HISTORY
Scan history
Every scan, manual or scheduled, newest first. Open one to see what each area found and what could not be checked.
HISTORY
CN
LATEST 50
Scans
SECURITY WORKSPACE / INCIDENT RESPONSE PLAN
Incident response plan
A plan written from your answers: who does what, who to phone, which laws and deadlines apply to you, and a record of any incident.
CN
SECURITY WORKSPACE / STAFF EXITS
Staff exits
Make sure nothing is left open when someone leaves: keys, devices, email, passwords and bank access.
CN
SECURITY WORKSPACE / EDAN
EDAN early warning
Early Detection And Notification. A decoy address that tells you when someone asks for it, which is often a scanner looking over your domain.
EDAN
CN
SECURITY WORKSPACE / REPORTS
Reports
A written summary of your latest results to print, save as a PDF or send to someone. It is built from what the dashboard holds right now.
REPORT
CN
To get a PDF, press the first button and choose "Save as PDF" as the printer. The CSV opens in Excel or Google Sheets and lists every finding, open or closed. Neither file contains passwords or raw evidence.
SECURITY WORKSPACE / ALERTS
Alerts
New critical and high findings from your scans, newest first. An alert is a lead to verify, not a confirmed incident.
ALERTS
CN
NEEDS ATTENTION
Urgent findings
DELIVERY
How you are told
SECURITY WORKSPACE / ABOUT OUR SOURCES
About our sources
Cybernocs reads public sources and your own website. This page lists each one, what we use it for, and what it cannot tell you.
CN
HOW TO READ YOUR RESULTS
What this service can and cannot do
- Every finding is a lead to verify, not a confirmed incident.
- Public sources are indicative, not exhaustive. Nothing here sees inside your network or your staff's devices.
- When a source is down, we say so. You will see "unavailable" or "partial" instead of a made-up answer.
- We never show passwords.
SOURCES
Where our information comes from
| Source | What we use it for | What it cannot tell you | Terms |
|---|---|---|---|
| Certificate Transparency (crt.sh) | Finds security certificates issued for look-alike versions of your domain, and subdomains you may have forgotten. | Free public service. It is sometimes slow or down; when it is, the scan says so instead of guessing. | Public service. We keep our request volume low. |
| DNS lookups (Cloudflare DNS-over-HTTPS) | Checks your domain's email protection records (SPF, DKIM, DMARC), nameservers and whether look-alike domains exist. | Shows what the public internet sees. It cannot see inside your network. | Public service. |
| Domain registration data (RDAP) | Shows how old a look-alike domain is. New look-alikes are more suspicious. | Not every registry answers. When one does not, we skip the age check and say so. | Public service. |
| Have I Been Pwned (breach list) | Tells you whether a company or service that holds your data was publicly breached. | It lists breaches of other organisations. It does not search for your staff's individual email addresses. | CC BY 4.0. Credit required, shown on the dashboard and on each finding. |
| RansomLook (ransomware listings) | Checks whether your organisation's name appears on ransomware criminals' public leak sites. | A name match is only a claim by the criminals. Always verify it before acting. Similar company names cause false matches. | CC BY 4.0. Credit required, shown. |
| abuse.ch (Feodo Tracker) | Checks whether addresses connected to you appear on lists of known botnet command servers. | Only covers addresses on the list. | CC0 (free to use). |
| CISA Known Exploited Vulnerabilities | Flags weaknesses in software you use that criminals are already attacking. | We can only match software we can identify from your website or that you declare. | US government publication. |
| NIST National Vulnerability Database | Provides the details and severity of known software weaknesses. | Free service with request limits. Descriptions are technical, so we explain them in plain words. | Free public data. |
| FIRST EPSS | Estimates how likely a weakness is to be attacked soon. | A probability, not a certainty. | Free public data. |
| endoflife.date | Tells you when the software you run stops getting security updates. | Only covers products on the site. | Free public API. |
| Your own website | Reads what your public website reveals: software versions, missing security settings, exposed files. | Looks only at what any visitor can see, and never logs in. | Your own site, checked with your permission. |
Licence terms are our understanding and are checked again before commercial use. Credit lines required by a licence are always shown.
WORKSPACE / ACCOUNT
Account & team
Your sign-in details and who can use this workspace.
ACCOUNT
CN
YOU
Your account
- Name
- —
- —
- Organisation
- —
Two-step sign-in
Checking…
Add this key to an authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, 1Password and similar), then type the 6-digit code it shows.
Save these recovery codes now. Each works once if you lose your phone. They are shown only this one time.
OWNERS ONLY
Team
| Name | Role | Two-step | Last sign-in |
|---|
Waiting invitations
Recent activity
Includes data from Have I Been Pwned (CC BY 4.0) and RansomLook (CC BY 4.0), and other public sources. About our sources