Use Case: Scam domains

Here is an example: 

I have a known exposed cloud bucket and I would like to find out all sites that are calling out to that bucket or have hosting files. I have tried just “bucketname.cloudservice.io” and I don’t get any results. I tried using web.hostname=~`bucketname.cloudservice.io` , nothing 

however, one of my collections is setup just to look for all the buckets, so I know there is data out there. I am currently looking at 300 domains in URLScan, so I know they are out there….

Hey there, welcome to the community and glad to hear your hunts are going well!

To speak to a few things you brought up:
 

• Regarding web.endpoints.http.body not always working for searches, an important thing to note is that only the first 2 kilobytes of HTTP headers and bodies are indexed and searchable in the Platform. You can directly look up an asset in the Platform web app or use the get host/get web property API endpoint to retrieve more header and body info, but I understand that doesn’t help with searching across this data in the platform.
  • You could try targeting:
    • http body hashes (web.endpoints.http.body_hash_sha1, web.endpoints.http.body_hash_sha256) instead. The first 65 kilobytes of an HTTP body are used to compose the hashes that are indexed and searchable in the Platform.
    • HTTP header data (host.services.endpoints.http.headers:(key= and value=) for hosts and web.endpoints.http.headers: (key= and value=) for web properties)
  • For additional example queries, check out the example queries page in the app. Some are basic, and some are more complex.
• I’d need a bit more information about the names you’re searching for to understand why your plain text and regex searches aren’t working as expected. Feel free to DM me if you prefer not to share it in the community proper.
• For AI query generation assistance, I highly recommend using the built-in query assistant in the Platform web app. It works directly from the search bar and you can input questions or prompts in a natural language and get a CenQL query in response. The query assistant is much better at generating valid and useful queries than any AI tool outside the app, IMO.

Let me know if you have any follow up questions. Hope this helps!

Thank you for the response! I am still new to censys and I am feeling a bit silly for not knowing that the API could get me different data. Once I got ahold of what I was looking at in censys, I was going to then create some automation using the API. Maybe I should just be looking at the api first. 

Let me give it a few tries and if I still run into issues, will for sure dm you as the data is kind of sensitive