Sees the campaign, not the link
Everything else waits for someone to report an address. ONYX watches how it spreads and catches it in minute three, without visiting the page.
See the scam while it spreads, not two days later.
ONYX links one person across connections, devices and browsers, decides what to do about it, and writes every decision into a log it can later prove was never rewritten. Argos connects ONYX to Discord. More connectors will follow.
8
Subsystems
4
Languages
0
Dependencies
6
Signals crossed
LiveAttacks in progress
Credential theftSession theftFake giftIP loggerMalware distribution
Malware distributionChina → Spainurlhaus
Malware distributionChina → Germanyurlhaus
Malware distributionGermany → United Statesurlhaus
Malware distributionGermany → Brazilurlhaus
Malware distributionUnited States → Spainurlhaus
Malware distributionUnited States → Germanyurlhaus
Malware distributionChina → Brazilurlhaus
Malware distributionGermany → Spainurlhaus
03 / ONYX
What makes ONYX different
Four decisions no other product in this space has made.
Decides in minutes, not days
A domain blocklist always arrives late: the site is renamed every week. ONYX does not wait for the list, it reads the shape of the spread and decides while it is happening.
Cannot lie quietly
Every verdict is signed and comes with a case file. If it is wrong, the mistake stays dated and cannot be withdrawn unseen.
Sees across communities
One server only sees that somebody posted a link. The pattern exists when you look at all of them, and that is where ONYX sits.
O
04 / ONYX
How it works
Three stages. None of them needs to visit the page or wait for somebody to report it.
1
Ingest
Connectors send sightings over an end-to-end encrypted channel. Neither the domain nor the account leaves the connector without going through it.
ONX-142
Correlation
Two engines look at different things: one at the SHAPE of the spread — the same domain across many communities at once — the other at the ORDER of events from a single account.
ONX-15 · ONX-163
Verdict
The answer is signed and timestamped. A wrong verdict stays on the record and cannot be withdrawn quietly.
ONX-11 · ONX-12What it is built on
Standard, auditable cryptography. Zero third-party dependencies at runtime.
Blind signature
RFC 9474
Handshake
SIGMA
Encryption
ChaCha20-Poly1305
Key derivation
HKDF-SHA256
Anti-replay
Sliding window
Runtime dependencies
None
How the work is splitREG-0172
ONYX holds the keys, keeps the log and issues the verdicts. Argos carries out in Discord what ONYX decides.
ONYX replies carry no instructions. They carry a verdict, a category and a confidence level. Each installation decides what to do with that.
That limit exists so a failure in ONYX does not become a failure in every server at once.
SubsystemsSIS-0173
ONX-09QUORUMCounts how many sites removed someone, without keeping a list of peopleIn ArgosONX-10TESTIGOSThird parties co-sign the log, so the signature does not rest on us aloneIn ArgosONX-11SELLADOWhoever operates ONYX cannot reach a customer's data without consent and a recordIn ArgosONX-12AVALProves good standing across communities without naming them or youIn ArgosONX-13SONDALink verdicts, from queries that do not reveal the linkPartialONX-14CANALThe encrypted channel between ONYX and its connectorsLiveONX-15ENJAMBRECross-community correlationLiveONX-16CADENAAttack chainsLive
What the server never receivesCIE-0174
This is how a query reaches ONYX. Black bars mark data the server never receives. Hover over one to see what is missing.
| field | what ONYX receives |
|---|---|
| group queried | a3f01c9d |
| address | |
| server | |
| who is asking | |
| exact time | |
| reply | 41 addresses from the same group |
4 bytes give 4,294,967,296 possible groups, and tens of thousands of addresses share each group. ONYX can tell which group you looked in, not which link it was.