Censys Platform use cases, findings, and queries

Hello, I am using Censys to identify scam domains by using OSINT indicators. After reviewing hundreds of websites, I have started to identify indicators of scam sites (specifically crypto investment fraud). I’ve found that the censys collection data is most useful! I’m getting hits almost daily on new scam sites. However, one issue that I have been running into is getting consistent results with the query. For example, I know there are certain images that I can link to specific templates of a scam site, but its hit or miss. I tend to use the web.endpoints.http.body , but it doesn’t always work.  I’m trying to build some cheat sheet queries. Are there any really good search examples out there? Funny enough, claude and chatgpt have not been very helpful on cleaning up my search parameters. 

In Todd Rosenberry’s blog he writes about operationalizing real-time Internet intelligence in your SOC with Censys integrations across Maltego, ThreatQuotient, and The Vertex Project, to achieve comprehensive Internet intelligence enrichment, faster investigations, and higher-confidence decisions.Learn MoreBlog LinkedIn X Bluesky

New guest blog from Nadav Shai Kanon, Solution Architect | Cortex, Palo Alto Networks on why AI SOCs need real-time Internet data context.Read “The Oracle Problem”: https://bit.ly/4fA1X3zAnd if you’re using Cortex XSOAR or XSIAM, Censys integrations are now live in the Palo Alto Networks marketplace: https://lnkd.in/d7GkSxFi

The Matched Fields/Service shows which service matches your query.But when you add a subnet (in the host.services.ip field) to your query, the Matched Fields disappear. host.services: (protocol:"FTP"): works perfecthost.services: (protocol:"FTP" and ip:"9.1.1.1/8"): goes wrong It works perfect Adding a subnet in CIDR notation introduces the bug   Do you have any ideas to fix this? Thanks!

Censys has teamed up with Microsoft Security to bring Censys Internet intelligence directly into Sentinel’s cloud-native SIEM/SOAR workflows to support both attack surface monitoring and SOC investigation.The reality is every alert tied to an external IP, domain, or certificate is a question of context. And without it, teams are left pivoting across tools, slowing down triage and response.With Censys and Microsoft Sentinel:🔷You keep your existing workflows🔷Visibility into Internet-facing assets and risk is built in🔷Triage and investigations move faster with more confidenceFrom exposure monitoring to investigation, better context leads to faster, more confident decisions.Learn how the Censys and Microsoft Sentinel modernize SOC workflows: https://bit.ly/48p2q4h

We’ve partnered with Splunk to bring Censys Internet intelligence and external exposure context directly into the workflows security teams already rely on. With Censys and Splunk, teams can:🔸Triage faster with more confidence🔸Reduce manual enrichment🔸Automate and scale response more consistently🔸Gain better visibility into changing Internet-facing riskFrom investigation to response, better context helps teams move faster and make stronger decisions.Learn how Censys & Splunk modernize SOC workflows: https://lnkd.in/g2V9xjH3LinkedIn | X | BlueskyHave questions ? Contact hkuly@censys.com

Check out this useful tool from a Censys user - you can use it to compare the results of a Legacy Search and Platform query to help you identify any differences in results between the two.It’s super useful to make sure you’re using the correct syntax in the Platform’s new domain-specific language and finding the results you’d expect from your queries. It’s very handy to use in tandem with the built-in Platform query converter.

Last week, we added new parsed redirect data fields to the Censys Platform. You can use them to map relationships, identify misconfigurations, find parked domains, locate abandoned infrastructure, and more.The fields are contained in a redirect_chain subobject on host service endpoints and web properties and are broken down as shown in the table below. All users can see these fields and all Core and Enterprise users can search across them.Field Description [host.services or web].endpoints.http.redirect_chain.reason The reason for the redirect. Can be HTTP_3XX, REFRESH_HEADER, or UNRECOGNIZED. *.endpoints.http.redirect_chain.transport_protocol The transport protocol used for the redirect. *.endpoints.http.redirect_chain.hostname The hostname that the redirect points to. *.endpoints.http.redirect_chain.path The path that the redirect points to, like /, /login, /admin, and so on. *.endpoints.http.redirect_chain.port The port that the redirect points to.  A fairly innocuo

Wanted to share this python script that one of my colleagues showed me. You can use it to quickly return useful information about a host including location, DNS, ports and protocols, and software information. If you have access to threat data, you can use the --include_threats tag to highlight that info in the readout as well.You’ll need to install the Platform SDK and prettytable to get it running.import argparsefrom censys_platform import SDK, RetryConfigfrom censys_platform.utils import BackoffStrategyfrom prettytable import PrettyTable# Parse argumentsparser = argparse.ArgumentParser(description="Retrieve data for a given IP address.")parser.add_argument("--ip", required=False, help="IP address to query")parser.add_argument("--include_threats", action="store_true", help="Include threats in the output")args = parser.parse_args()ip_address = args.ip if args.ip is not None else "34.0.51.123"include_threats = args.include_threats# API Key and Org ID for Platformorganization_id = "ORG_I

I have a free Censys account with credits topped up. I have reviewed the documentation for the Censys Platform API. The documentation explains that Organization ID’s are only available for starter and enterprise accounts. However, it also says including these in the query parameters is completely optional. Yet every time I test the API I see this error. I do not have an Organizational ID and I cannot get one. What’s the deal?

I’m attempting to convert my queries to the new query syntax. There is one field that I use frequently that will not convert: services.extended_service_name. The error I get back is that it is not available on the censys platform.Is this a known issue? Was this field migrated but not mapped for the query converter tool?Thanks

I was wondering if it was possible to get more than 2000 results using the aggregate API endpoint.

Hello again! In this week’s Cool Query of the Week, I’m highlighting a way to search for certificates containing a specific name that expire in the next month. Swap out the example domain for your domain of interest and set up a collection to get alerts when new certificates are added to this query’s results.cert.parsed.subject.common_name: "example.com" and cert.parsed.validity_period.not_after >= "now" and cert.parsed.validity_period.not_after < "now+1M"

Hello again! In this iteration of Cool Query of the Week, we’ve got a query for hosts labeled as open directories that contain executable files in their endpoints’ HTTP bodies. Narrow this down with other executable file extensions, geographic ranges, or whatever else is important to you.host.services.endpoints.http.body: {".exe", ".hta"} and host.services.labels.value: OPEN_DIRECTORYAs a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

Hello again! In this iteration of Cool Query of the Week, we’ve got a query that can find web properties that may be attempting to impersonate Facebook login pages. This is accomplished by looking for the phrase “Facebook - log in or sign up” in HTML titles on web properties that are not accompanied by a legit facebook favicon.web.endpoints.http.html_title: "Facebook - log in or sign up" and not web.endpoints.http.favicons.hash_sha256: {88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7, 8924f44d76426a340b105cbdc5b93678c6b772e847b393f2568d94847c0d8d80}As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

Hello again! In this iteration of Cool Query of the Week, I highlight how to search for certificates that contain an eTLD+3 or greater subdomain of a given domain. In this example, I’m targeting example.com, which you should swap out for your domain-of-interest.This query also uses regular expression (regex). In the Platform, as with Legacy Search, regex in queries is only available to paying customers. However, anyone can get access to regex on the Platform by buying Censys Credits.cert.names=~`.*\..*\.example\.com$`Learn more about regex in Censys Query Language in the docs.As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

Hey all! I’m bringing back our Cool Query of the Week series with a focus on writing queries in the new Censys Query Language for use on the Platform. You can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.This week I’m starting off with a query that highlights some of the web assets you can find by searching across web property endpoints.This query returns web properties with potentially sensitive exposed paths. You can combine this with other criteria like your organization’s name or known web assets to narrow its focus.web.endpoints: (path= {"/config", "/logs", "/uploads", "/backups"} and http.status_code: 200)Learn more about web properties in the docs.