Continuous exposure checks for Onamae-linked domains and certificates: what ZoomEye can answer
The Onamae.com Desktop Cloud incident shows the value and the limit of an outside view. A security team can see public domains, services, certificates, and banners without accessing the provider's internal management plane. That view can support inventory and monitoring, but it cannot prove malware execution, customer impact, or the provider's root cause.
On November 1, 2026, AutoPR ran four successful all-asset ZoomEye queries for this event. The results were 0 observations for domain="onamae-desktop.com", 40 for domain="onamae.com", 96 for ssl="onamae.com", and 427 for ssl="onamae". The final query is the broadest because it matches the word Onamae in certificate text. None of the four is a victim count.
Define the question before the query
A domain query asks whether ZoomEye has an indexed observation associated with that domain. A certificate-text query asks whether indexed certificate material contains a string. Those questions are useful for finding public names that may belong in an asset inventory. They are not substitutes for authoritative DNS records, certificate transparency logs, provider asset records, or customer telemetry.
Write the decision the observation will support. If the goal is to verify that all provider-related public names are approved, compare the returned names and certificates with the organization's register. If the goal is to detect new public infrastructure, collect repeat observations and investigate changes. If the goal is to determine whether a customer server was affected, use provider and endpoint evidence instead.
Preserve the query record
Record the exact normalized dork, scope, query time, and count. Preserve the result ID if the command returns one. Keep the distinction between a successful zero and an error. A failed request is not evidence that a domain disappeared, and a missing result can reflect collection coverage, index timing, or a query that is too narrow.
The four observations are a single snapshot. They should not be plotted as a trend until repeated with the same dork, scope, and collection method. A count that rises from one run to the next may reflect indexing changes, brand use, unrelated certificates, or query behavior. The only defensible statement from the November 1 data is the count observed at that time.
Build an ownership workflow
Every returned asset or certificate needs an owner, purpose, expected lifetime, and response action. A certificate containing Onamae may belong to a provider service, a customer configuration, a third party using the brand, or an unrelated string match. Do not call it confirmed service ownership without another source.
The workflow should answer four questions. Is the name expected? Does the certificate belong to an approved service? Is the public exposure still necessary? Does the asset have an accountable team and monitoring path? A no to the first three should create a validation task, not an immediate destructive change.
Use the provider's official contact and status channels to validate critical assets. If the provider is in an active incident, document that the management portal may be unavailable and use a prearranged alternate path. External observation should support, not replace, the provider's evidence.
Watch the right changes
High-value changes include a new public domain, a changed certificate issuer or subject, a certificate that appears outside the approved inventory, and a provider-linked host that remains visible after an announced retirement. A security team can schedule checks and retain snapshots, but should not flood responders with raw count changes.
Set an alert only when a change has a decision attached. For example, a new certificate for a production domain may require owner validation, while a broad brand-text count change may be informational. Document the threshold and the person who reviews it.
Keep the evidence boundary visible
The Onamae incident's 26,739 figure describes servers that may be affected, not confirmed compromises. GMO has confirmed that customer information was taken outside the company and that attackers published claimed data, but the reviewed public reports do not identify the intrusion vector or a confirmed total. External observations cannot fill those gaps.
That is not a reason to ignore them. A disciplined outside-in program can catch forgotten names, unmanaged certificates, and public services that do not match the inventory. The value comes from linking the observation to an owner and a decision. A count without that context is just a number.
Top comments (0)