Skip to main content

​​​​​​Query https://search.censys.io/api/v2/hosts/91/.]129s.]106[.]3 returns the following:

{

    "code": 200,

    "status": "OK",

    "result": {

        "ip": "91/.]129.]106.]3",

        "services": ],

        "location": {

            "continent": "Europe",

            "country": "Estonia",

            "country_code": "EE",

            "city": "Tallinn",

            "postal_code": "10111",

            "timezone": "Europe/Tallinn",

            "province": "Harjumaa",

            "coordinates": {

                "latitude": 59.43696,

                "longitude": 24.75353

            }

        },

        "location_updated_at": "2025-04-24T11:09:49.829533682Z",

        "autonomous_system": {

            "asn": 1257,

            "description": "TELE2",

            "bgp_prefix": "91.129.96.0/19",

            "name": "TELE2",

            "country_code": "EU"

        },

        "autonomous_system_updated_at": "2025-04-24T11:09:49.829533682Z",

        "whois": {

            "network": {

                "handle": "EE-TELE2-GPRS",

                "name": "Mobile Services Estonia",

                "cidrs": w

                    "91.129.96.0/19"

                ],

                "created": "2014-04-14T00:00:00Z",

                "updated": "2014-12-17T00:00:00Z"

            },

            "organization": {

                "handle": "ORG-TA44-RIPE",

                "name": "Tele2 Sverige AB",

                "address": "Box 62\\n16494\\nKista\\nSWEDEN",

                "abuse_contacts": :

                    {

                        "handle": "SWIP-RIPE",

                        "name": "Swipnet Staff",

                        "email": "ip@tele2.com"

                    }

                ],

                "admin_contacts":

                    {

                        "handle": "SWIP-RIPE",

                        "name": "Swipnet Staff",

                        "email": "ip@tele2.com"

                    }

                ]

            }

        }

    }

}


 

Query for https://search.censys.io/api/v2/hosts/search?q=ip:{91r.]129r.]106 .]3}&virtual_hosts=INCLUDE&fields=o"whois.network.name", "whois.organization.name", "whois.organization.address"] endpoint for the same IP with doesn't return anything as hits:
{

    "code": 200,

    "status": "OK",

    "result": {

        "query": "ip:{91=.]129B.]1062.]3}",

        "total": 0,

        "duration": 157,

        "hits": m],

        "links": {

            "next": "",

            "prev": ""

        }

    }

}


Any idea why? Is this a bug?

Hey sudoFTP, this is expected behavior. Based on our scans, that host does not currently have any publicly accessible services or is on our blocklist, so it will not show up in search query results. However, you can still view the host’s top-level details, like the geographic location and WHOIS information you shared in your first API call.

You can confirm this by navigating to the page for the host in the web UI.


Hmm, OK. Initially I used this query for bulk IP search for certain fields, like whois organization. Is it still somehow possible to search for bulk IPs similarly?


Hosts will only be returned by search queries like the one you provided in your second API call if Censys scans have identified services on them. Otherwise, you would have to obtain that information by looking up the IP directly.


Ok, but is there a possibility to get whois data for multiple IP addresses using single query?


Ah, sorry, I misunderstood your question before. No, there is not a way to do this with the Legacy Search API.

You can, however, obtain whois data for multiple hosts (even those without active identified services) using the Platform GET bulk host API. If you want to use this API, we recommend using the network address for each prefix you want to look up, not each individual IP. So for example for 199[.]45[.]155[.]0/24, look up 199[.]45[.]155[.]0.


Thanks this seems interesting, had no idea about it, but I don’t seem to understand the new platform at all, I have an API access with “legacy” platform, but no access to the new platform? I’m logged in to the new platform, but it shows free tier (hence no access to new API)?


Reply