Skip to main content

Search findings, use cases, and queries

Share useful Search queries, interesting things you've found, and more.

  • 31 Topics
  • 37 Replies
31 Topics
V
vitutusNew Participant
asked in Search findings, use cases, and queries
Censys Platform Equivalent of Legacy "last_updated_at" API

I was able to grab the “last_updated_at” timestamp from the legacy Censys API search endpoint. I’m trying to get the equivalent from the new API.Correct me if I’m wrong, but I’m guessing the correct timestamp is the latest among the host.services.scan_time entries. Assuming this is the case, I haven’t been able to get this data directly from the sdk’s global_data.search function. resp = sdk.global_data.search(search_query_input_body=models.SearchQueryInputBody( fields = [ "host.ip", "host.services.scan_time" ], page_size = 1, query = '''host.services.endpoints.http.headers:(key:"Cross-Origin-Opener-Policy" and value:"same-origin-allow-popups; report-to=\\"gws\\"")''', page_token = page_token))Ultimately, the resp.result.result.hits entries have:{'ip': '149.36.239.166', 'services': [{}, {}, {}, {}, {}]}Will I instead need to query sdk.global_data.get_hosts() with the extracted ips to get the scan times? # results are all of the

212
V
S
sudoFTPNew Participant
asked in Search findings, use cases, and queries
/hosts/{ip} returns data, but /hosts/search/ endpoint doesn't return anything for the same IP

​​​​​​Query https://search.censys.io/api/v2/hosts/91[.]129[.]106[.]3 returns the following:{    "code": 200,    "status": "OK",    "result": {        "ip": "91[.]129[.]106[.]3",        "services": [],        "location": {            "continent": "Europe",            "country": "Estonia",            "country_code": "EE",            "city": "Tallinn",            "postal_code": "10111",            "timezone": "Europe/Tallinn",            "province": "Harjumaa",            "coordinates": {                "latitude": 59.43696,                "longitude": 24.75353            }        },        "location_updated_at": "2025-04-24T11:09:49.829533682Z",        "autonomous_system": {            "asn": 1257,            "description": "TELE2",            "bgp_prefix": "91.129.96.0/19",            "name": "TELE2",            "country_code": "EU"        },        "autonomous_system_updated_at": "2025-04-24T11:09:49.829533682Z",        "whois": {            "network": {                "handle": "EE-TE

2038
J
F
fmush96New Participant
asked in Search findings, use cases, and queries
Body query related question

Hey!I want to understand a little bit more about how Censys scan works. I was testing the following query: “host.services.endpoints.http.body : "CNPJ: 06.626.253/0001-51" and no results are given. Otherside, on FOFA, with the following query “body="CNPJ: 06.626.253/0001-51" i can see a few hosts. So how does the body query on Censys works? Does FOFA scan deeper than Censys or just a limitation on body attribute?

451
MattK_Censys
D
DenTNew Participant
asked in Search findings, use cases, and queries
The * symbol is not working

Good afternoon, the “*” symbol worked fine on the old platform, for example, I want to find cameras by a specific domain and make a request: “camera*.keenetic.*” at the same time, I get several hundred results (including cameravilla.keenetic.pro; camerahome.keenetic.link and many others), but when on a new platform I enter the same query “camera*.keenetic.*” I only get one response, for example: viagesu-camera.keenetic.link.The "*" sign is simply ignored in any combinations.At first, I thought these were temporary difficulties when switching to a new platform, but today I still could not adequately create a query so that the “*” symbol would work as indicated in the manual. 

828
R
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for October 10, 2024: Using the new suspicious open directory label

Hey hey folks, this week I’ve got a query that leverages our new suspicious open directory label. While simply running labels: suspicious-open-dir can be a good starting point in general, combining it with other information of interest can get you really moving in an investigation. Try the following with hosts:labels: suspicious-open-dir and services.http.response.body: "cve"This will return hosts with the suspicious open directory label and “cve” in the service response body. Sub a different indicator of interest in there and take it away!This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

1102
MattK_Censys
S
SusmitaNew Participant
asked in Search findings, use cases, and queries
Censys Search quota usage graph

Hey all,Is there a place where I can check my account’s search usage graph over a period of last 3 months?

431
MattK_Censys
A
AUS_CNew Participant
asked in Search findings, use cases, and queries
Wordpress Plugin

Could someone please advise the search query syntax for wordpress plugins? Ex: GiveWP, WP Automatic

1012
A
W
welltestNew Participant
asked in Search findings, use cases, and queries
While generating API key for free it shows You do not have access to the Censys API. Previously it was working fine.

While generating API key for free it shows You do not have access to the Censys API. Previously it was working fine.  

6141
MattK_Censys
M
MariNew Participant
asked in Search findings, use cases, and queries
How to export All result from API without hitting the rate limit

Hi,I have a query which return 200K hosts. I need to download all.if I use the following code, after 300 query rate limit will stop the script.query = h.search ("SEARCH TERM", per_page=100, pages=-1)Also I used another approach, which download lots of repetitive datafor page in range(1, 100):query = h.search( 'services.port: 80 AND services.tls.certificates: * AND services.http.response.status_code: 403', per_page=100, page=page) any IDEA how to download all data without problem.

1734
M
Z
zan2323New Participant
asked in Search findings, use cases, and queries
i need ip from this (not cloudflare) anyone can help me?

raleigh-m.vip - this website is protected with cf, and i want know about him server. any answer is a help for meeeee thxx

581
MattK_Censys
S
SusmitaNew Participant
asked in Search findings, use cases, and queries
How do we export search results from Censys Search in windows?

How do we export search results from Censys Search in windows?

2313
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for October 25, 2024: Intro to using historical data in Search

For this week’s cool query I’m deviating again from sharing a formal query and instead diving into another component of Search: accessing and using historical data.I recently published this lesson in the Censys Academy that walks through how to find and use historical data in Search. It uses both the web interface and the API. Check it out here.This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

750
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Learn how to discover OT and IOT devices in our new ebook

Our team just released a fresh ebook - Unleash the Power of Censys Search: A Hassle-Free Handbook for Cyber Heroes.There’s a lot of great content in here but one of the things I find most helpful was the example covering how to discover operational technology (OT) and internet of things (IOT) assets in Search.You can start by inputting protocols and names/manufacturers of interest in plaintext. The example in the ebook starts with:BACnet and siemensWhich you could then combine with a key-value pair like a service port:BACNet and siemens and services.port= 80 Which can return potential HMIs accessible by the outside world. Find more info about this example as well as other great queries in the ebook!

490
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for October 16, 2024: Tracking recently-added certificates on spoofed domains

Howdy! This week I’m sharing a query that targets certificates. Use this to find certs that were added to the Censys dataset within the past week that are being used on spoofed domains that could indicate suspicious behavior. Combine this with known malicious domains to stay ahead of potential risks.In this example, I used dnstwister to find suspect domains that might be impersonating censys.com. You could use regex instead to match patterns.(densys.com or xensys.com or ce.nsys.com) and added_at:[now-1w to now]This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

620
MattK_Censys
T
T3chn3New Member
posted in Search findings, use cases, and queries
Open for Business: How Open Directories Expose Bulletproof Hosting Operations

Hi everyone,I just published a new blog post, and I'd love for the Censys community to check it out! In my research, I dive into how open directories can reveal the inner workings of bulletproof hosting operations. If you're interested in cybersecurity and the risks associated with exposed open directories, I think you'll find it insightful.You can read it here: Open for Business: How Open Directories Expose Bulletproof Hosting Operations.Looking forward to your thoughts and feedback!

1161
AidanH_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for September 19, 2024: Find hosts with a page title on an HTTP service containing the word "dashboard"

Hey all! This week I’ve got one with a couple of different uses. This will return hosts (or virtual hosts, if you include them) with a page title on an HTTP service that contains the word “dashboard.”services.http.response.html_title: "dashboard" ASM users can use a version of this in their attack surface inventory, along the following lines:host.services.http.response.html_title: "dashboard" This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

420
MattK_Censys
M
Matthew Embee ResearchNew Participant
posted in Search findings, use cases, and queries
Hunting Query For Remcos RAT

 Hey allCame across another cool query to share with you. This time for Remcos C2’s, and was based on an initial post from drb_ra on X. same_service(services.banner_hashes="sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" and services.tls.certificates.leaf_data.signature.self_signed=`true` and not services.tls.certificate.parsed.subject_dn:?* and not services.tls.certificate.parsed.issuer_dn:?* and services.tls.ja4s: t130200_1301_234ea6891581) The main part of the query is this empty certificate and JA4s value. As well as an empty service header on the same port. There’s some cool hits for Remcos with 0 VT on the C2. I haven’t been able to check all of the results yet. Although many so far are known C2’s for Remcos.  

2011
MattK_Censys
M
Matthew Embee ResearchNew Participant
posted in Search findings, use cases, and queries
Hunting Astaroth Malware Domains With Redirects

Hey All,  Came across a cool query to find the Astaroth domains from this twitter post. https://x.com/johnk3r/status/1833899781099524181The apex domains (ignoring subdomain) all seem to redirect to twitter, linkedin or instagram which is strange. Combined with the unusual .cfd domain, it’s unique enough to make a query.This works best if you have regexservices.http.response.headers: (key: `Location` and value.headers:/https?:\/\/(www\.)?(instagram|x|twitter|linkedin).com/) AND services.tls.certificates.leaf_data.names:"*cfd"For those without regex, you can use this and replace instagram with linkedin, twitter or x. services.http.response.headers: (key: `Location` and value.headers:`https://www.instagram.com`) AND services.tls.certificates.leaf_data.names:"*cfd" 

1800
M
john
johnFrequent Contributor
posted in Search findings, use cases, and queries
ChatOps for Open Port Monitoring

Ports accidentally being opened to the Internet is an age-old problem. This results in regular firewall reviews or, worse, having the port identified with a discovered vulnerability, raising the risk to the organization. Increasing complexity, continuous deployments, and chances of misconfigurations have increased the need for third-party validation.I built Lunker Zero for ChatOps to perform regular checks with Censys Search to determine when ports are open/closed based on the Autonomous System (AS) number query results.

521
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
CQOTW for September 5, 2024: Script edition: Monitoring new certs that could be impersonating an organization

Hey all, this week I’ve got a script that you can use with Censys Python to monitor newly-issued certificates that could be impersonating an org. Fill in the org name and date desired for your purposes:from censys.search import CensysCertsimport timeimport jsonDATE = '2023-12-30'start_time = time.time()c = CensysCerts()certs_dict = {}all_certs = []# Single page of search resultsquery = c.search(f'\"organization\" and parsed.extensions.subject_alt_name.dns_names: \"*organization*\" and added_at:[{DATE} to *]', per_page=100, pages=-1)count = 0for page in query: count += 1 print(f"page {count}") # print("--- %s seconds ---" % (time.time() - start_time)) for cert in page: all_certs.append(cert)certs_dict['data'] = all_certswith open("results.json", "w") as outfile: json.dump(certs_dict, outfile)print("--- %s seconds ---" % (time.time() - start_time)) This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use

1090
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for August 29, 2024: Searching for typosquatted domains

This week I’ve got a hosts query to help you locate potentially typosquatted domains. This one uses regex and looks for DNS names in host records that start with “cens” and then have exactly two characters following that before a variety of TLDs, notably not including .com: dns.names: /cens.{2}\.(xyz|info|top|net|org|biz|name|io)/ This was formatted to return results that may be similar to Censys.If your Censys account doesn’t have access to regex in queries, you can use wildcards or a tool like dnstwist to identify specific domain names that you want to investigate with a targeted search.This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

1320
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for August 6, 2024: C2IntelFeeds and queries from drb-ra

This week I wanted to highlight some useful content from the broader community: C2IntelFeeds by drb-ra. drb-ra shares likely C2 servers on their twitter feed and many useful queries for finding likely C2 are provided in their Git repo. For example:BianLian Go Trojan: same_service(services.tls.certificates.leaf_data.subject_dn=/C=[0-9a-zA-Z]{16}, O=[0-9a-zA-Z]{16}, OU=[0-9a-zA-Z]{16}/ AND services.tls.certificates.leaf_data.issuer_dn=/C=[0-9a-zA-Z]{16}, O=[0-9a-zA-Z]{16}, OU=[0-9a-zA-Z]{16}/) Qakbot: same_service(services.jarm.fingerprint={"21d14d00021d21d21c42d43d0000007abc6200da92c2a1b69c0a56366cbe21","04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e"} AND services.http.response.body_hash="sha1:22e5446e82b3e46da34b5ebce6de5751664fb867") OR same_service(services.banner_hashes="sha256:5234096d7003929ad67037af6f5816933cab9e85f9b286468249ac9ab9bfb861" AND services.http.response.body_hash="sha1:22e5446e82b3e46da34b5ebce6de5751664fb867") OR (services.tls.certificates.leaf_data

1270
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for July 31, 2024: Newly-created certificates with localhost in subject or issuer name

This week we’ve got another complex query. This one looks for certificates with localhost in the subject or issuer name that were created in the last 7 days. This could potentially point to misconfigured environments or systems exposed to the Internet. This query was shared by Emily on our research team.(parsed.subject.common_name: "localhost" or parsed.issuer.common_name: "localhost") and parsed.validity_period.not_before: [now-7d to now] This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

690
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for July 25, 2024: Recently-issued certs on login pages

This week we’ve got a complex query that leverages our relative time variables to identify recently-issued (within the last 6 hours) certificates that are present on hosts with exposed login pages. Certs like this could be used to impersonate an organization for phishing or MITM attacks. Thanks to Morgan on our team for highlighting it.services: ((tls.certificate.ct.entries.value.added_to_ct_at: [now-6h to *]) and (labels: login-page)) Combine this query with fields like the following to look for hosts that could be used to impersonate a specific organization or service.dns.names:  [orgname][.]com services.tls.certificate.names:  [orgname][.]com services.tls.certificate.parsed.subject.organization: “Org Name” services.http.response.html_title: *[orgname]* whois.organization.name: “Org Name” whois.organization.tech_contacts.email: *@[orgname][.]comThis is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search

920
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for July 17, 2024!

Howdy! This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!This is a pretty simple one, but is useful to know regardless. If you know the specific SHA 256 fingerprint of a given certificate, you can use the services.tls.certificate.fingerprint_sha256 field to search for all hosts presenting it. For example:services.tls.certificate.fingerprint_sha256: "e827dd2376f59c655eb5bae5499977dd08d3f851573c4cf5688ded097205a7dd"

890
MattK_Censys

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us