New twist function for Platform search queries, matched services in the Platform UI and API, eight new fingerprints, and one Rapid Response bulletin.

Platform

• Use the new twist function in your Platform queries to find field values that are similar to a specified value.
  • You can use the twist function to find typosquatted domains or domains attempting to impersonate a valid domain by omitting known domains from your query. For example, the following query will find web properties that use names similar to censys.io but will omit results that include censys.io.

    twist(web.hostname, 'censys.io') and not web.hostname:'censys.io'
    

• Use matched services in the UI and API to rapidly find host services that contain data that match your search criteria.

  • Matched services in the UI are shown in the Matched Fields section. Click the service icon to navigate directly to the service card on the host.

    
  • Matched services in the API are returned in a matched_services object for each host that contains matching data.

              "matched_services": [
                {
                  "protocol": "HTTP",
                  "port": 18083,
                  "transport_protocol": "tcp"
                }
              ]
    

• The Share link action was moved to the Search Actions menu next to the search bar in the Platform web UI. Use this to generate share links for assets, search query results, and more.

  

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

• SNMP RCE in Cisco IOS and IOS XE Software [CVE‑2025‑20352]
  • The queries below can help identify any affected Cisco devices exposing SNMP, but they are not necessarily vulnerable. 
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.