ONYPHE — the verified scanner block and why the official list isn't enough
by shop owners for shop owners.
How the PARC feed for ONYPHE was built: ONYPHE publishes an official list, but it is incomplete. Via multilingual forum/search-engine research + bidirectional FCrDNS against *.probe.onyphe.net we confirmed 8 additional active probe blocks, including customer-dedicated US scanners.
ONYPHE is an internet-wide attack-surface and CTI scanner from France (since 2017) — it scans the internet and dark web for exposed assets. Not an SEO tool. ONYPHE behaves exemplarily („Ethical Internet Scanning"): fixed IPs, reverse DNS pointing to their own project, opt-out by email. They even publish an official list — which, as we found, does not cover the entire active probe fleet. We proved the rest via bidirectional FCrDNS against *.probe.onyphe.net. Part of our PARC Security feed.
onyphe.json — view feed ONYPHE — official list →
The blocks
14 IPv4 ranges (1,424 addresses) + 3 IPv6 — official plus FCrDNS-confirmed:
Official (ONYPHE's own ASN AS213412, www.onyphe.io/ip-ranges.txt):
91.196.152.0/24 91.230.168.0/24 91.231.89.0/24
94.231.206.0/24 195.184.76.0/24 51.254.49.96/28
2a14:f100::/29 2001:41d0:33a:a00::400/124 2001:41d0:33d:9200::400/124
Additional, proven via FCrDNS (NOT in the official list):
5.196.200.240/28 (OVH EU — general probe block, still active)
51.81.14.224/28 scanner1us.tmhcc.probe.onyphe.net
147.135.26.176/28 scanner2us.tmhcc.probe.onyphe.net
51.81.26.64/28 scanner3us.tmhcc.probe.onyphe.net
51.81.253.64/28 scanner4us.tmhcc.probe.onyphe.net
51.81.228.240/28 scanner5us.tmhcc.probe.onyphe.net
51.81.218.64/28 scanner6us.tmhcc.probe.onyphe.net
147.135.58.160/28 scanner7us.tmhcc.probe.onyphe.net
Why the official list isn’t enough
ONYPHE’s ip-ranges.txt cleanly lists their own scan ranges — all five /24s come from ONYPHE’s autonomous system AS213412. What’s missing are the customer-dedicated scanners: ONYPHE runs dedicated scanner instances for individual customers (recognisable here by the tmhcc label), hosted at OVH US (AS16276) — seven /28 blocks, systematically named scanner1us…scanner7us. These scan the internet just the same, so to a shop operator they are equally ONYPHE traffic — yet they do not appear in the official list. On top of that, 5.196.200.240/28, another active probe block (OVH EU), was in an older version of the list and silently removed, but keeps running.
How we found the additional blocks
Multilingual research across several search engines (EN/DE/RU) surfaced probe hostnames and IP ranges not in the official list. We then bidirectionally FCrDNS-checked every candidate — and the systematic naming scheme let us enumerate the complete blocks via scannerNus-01 resolution:
Forward (hostname -> IP):
scanner3us-10.tmhcc.probe.onyphe.net → 51.81.26.73
Reverse + forward-confirm (each of the 16 addresses per /28):
51.81.26.64 → scanner3us-01.tmhcc.probe.onyphe.net → 51.81.26.64 ✓
5.196.200.241 → cruz.probe.onyphe.net → 5.196.200.241 ✓
Each of the 128 addresses in the eight additional /28s resolves bidirectionally to *.probe.onyphe.net (16/16 per block). The official /24s come from ONYPHE’s own ASN and are taken as their published declaration.
Reverse-DNS patterns
{name}.probe.onyphe.net (general probes: danny, smith, cruz …)
scanner{N}us-{NN}.tmhcc.probe.onyphe.net (customer-dedicated US scanners)