Skip to main content

Recently active topics

16 Topics
S
sudoFTPNew Participant
asked in Search findings, use cases, and queries
/hosts/{ip} returns data, but /hosts/search/ endpoint doesn't return anything for the same IP

​​​​​​Query https://search.censys.io/api/v2/hosts/91[.]129[.]106[.]3 returns the following:{    "code": 200,    "status": "OK",    "result": {        "ip": "91[.]129[.]106[.]3",        "services": [],        "location": {            "continent": "Europe",            "country": "Estonia",            "country_code": "EE",            "city": "Tallinn",            "postal_code": "10111",            "timezone": "Europe/Tallinn",            "province": "Harjumaa",            "coordinates": {                "latitude": 59.43696,                "longitude": 24.75353            }        },        "location_updated_at": "2025-04-24T11:09:49.829533682Z",        "autonomous_system": {            "asn": 1257,            "description": "TELE2",            "bgp_prefix": "91.129.96.0/19",            "name": "TELE2",            "country_code": "EU"        },        "autonomous_system_updated_at": "2025-04-24T11:09:49.829533682Z",        "whois": {            "network": {                "handle": "EE-TE

60
S
S
Senior ShadeFrequent Contributor
asked in Search Q&A
API Request

I have read all the documentation but nothing is clear, how do I and what is the right thing to use for the request, one page says need API ID and Secret, another page says Token and Organization ID, I need to submit a request to Censys Search and I have 500 credits, but how do I do submit the request?

427
MattK_Censys
A
atwNew Participant
asked in Search Q&A
What is the API ID?

I just started using Censys Search and want to export search results which I understand requires using the Censys CLI. So I’ve installed https://github.com/censys/censys-python and created a PAT at https://accounts.censys.io/settings/personal-access-tokens?org=xxx-xxxxxx but when attempting to authenticate I get a “failed to authenticate” error. Your documentation at https://docs.censys.com/reference/get-started is unclear in what the "Censys API ID” is, it sounds like it’s the Organization ID, which I tried to use. I’ve also tried the token name, and my email address. None seem to work. Here is the output: ❯ censys configCensys API ID: xxx-xxxxxxCensys API Secret: censys_9xxxxxxx7R_JbsxxxxxxxxxxxGSDo you want color output? [y/n]: yFailed to authenticate So I’m asking for clarity on what the Censys API ID is supposed to be. And if it is the Org ID, than any other ideas on why it’s failing to authenticate? I already checked RBAC and my user does have “API Access” enabled.

656
A
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 21, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Unauthenticated RCE in Erlang/OTP (CVE-2025-32433) Use the following queries to identify exposed Erlang SSH servers. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query New fingerprintsAdded the following fingerprints. Type Name Description Query software Microsoft Power Apps A modern low/no-code solution developed by Microsoft. Platform query   Legacy Search query software Erlang SSH This is an Erlang SSH Server. Platform query   Legacy Search query software AQUILA Radiology Imaging Software by IMEXHS AQUILA is a radiology imaging software platform that provides digital

140
MattK_Censys
T
tzh00203New Participant
asked in Censys Platform Q&A
Error downloading Universal Internet Dataset using the API

I've requested research access for my account. And I have been set the right value for $CENSYS_API_ID and $CENSYS_API_SECRETHowever, the server sends me “error message” so I seek for help to download data with my api.curl -X "GET" "https://search.censys.io/api/v1/data/universal-internet-dataset-v2-ipv4" -H "Accept: application/json" --user "$CENSYS_API_ID:$CENSYS_API_SECRET"{"status": "error", "error": "This server could not verify that you are authorized to access the document you requested.  Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.", "error_type": "unknown"}

383
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 14, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Vulnerability in FortiSwitch Allows Unauthenticated Attackers to Change Admin Passwords (CVE-2024-48887) Use the following queries to find Fortinet FortiSwitch instances. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query Actively Exploited Deserialization Vulnerability in Gladinet CentreStack Secure File Sharing Software (CVE-2025-30406) The queries below can be used to identify exposed instances of Gladinet CentreStack, but they are not necessarily vulnerable to the exploit. Platform query Legacy Search query ASM query ASM risk query This query can be used to identify exposed instances of Gladinet CentreStack that are vulnerable to the exploit. New fingerprintsAdded the follow

200
MattK_Censys
R
RittickFrequent Contributor
asked in Censys Platform Q&A
Support for "host.whois.network.cidrs"/ "whois.network.cidrs" in Report Builder

Hi Censys Team,I'm trying to generate a report in the Report Builder using the host.whois.network.cidrs/whois.network.cidrs (in legacy censys) field to analyze CIDR blocks associated with WHOIS records, but it seems this field is not currently supported. When attempting to build the report, I get the following error in the legacy one:Error 422. Invalid field: Term aggregations are not supported. If you believe this is an error on our part, please contact us. and here's a screenshot for the same in new platform:It appears that term aggregations for host.whois.network.cidrs / whois.network.cidrs are either disabled or not yet implemented in the Report Builder. This field would be extremely useful for understanding IP space distribution across organizations or registrants at a CIDR level.Could you please confirm if this field will be supported in future updates? If not currently on the roadmap, I’d love to request this as a feature enhancement.Thanks in advance!

201
MattK_Censys
L
luca.malatestaNew Participant
asked in Other security topics
Hystorical data retention for ip scan

Hello, I need to do a historical search of the open ports of one of our public IPs, I wanted to know if by buying Censys credits I can do this historical search and how far back I can go.Thanks

291
MattK_Censys
M
mmollemaNew Participant
asked in Search Q&A
Cancellation for Teams Plans failed

Anyone else faced the following issue? We have tried to cancel our Teams plan in several ways, but failed:By updating “Payment Settings” through My Account. The given “contact support” blue-button does not work; For Teams plan, no support is provided. So the ticket system auto-denied the request. By contacting self-service@censys.com. No response. Calling the listed US phone-numbers, no contact. Was able to leave voice message though, but no follow-up unfortunately.Is there any other way to change payment setting or cancel this subscription? What is the best way to resolve this?

201
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Announcements
New Threat Hunting Module - Join Censys & Silas Cutler for a Private Briefing

Join Censys and renowned malware analyst Silas Cutler for an exclusive briefing on the BeaverTail malware, ongoing campaigns by North Korean threat actors, and monitoring C2 infrastructure with Censys.Be the first to see Censys' new Threat Hunting ModuleSee how Censys is helping security teams hunt faster, accelerate investigations, and eliminate threats before they attack. Learn how to perform on-demand scanning, historical analysis, and advanced pivoting to uncover and track adversary infrastructure in real-time with Censys. WHEREHistoric Lounge, Ferry Building1 Ferry Building, The EmbarcaderoSan Francisco, CA 94111United States of America WHENMonday, April 28, 20253:00 - 6:00 PMNetworking and refreshments with presentation from 4:00 PM - 5:00 PM Why Attend?Exclusive Intelligence – Get the latest insights on new and evolving malware infrastructure out in the wild First Look at Innovation – Experience how Censys' Threat Hunting Module delivers real-time threat visibility and actionabl

190
MattK_Censys
C
Censys_PowerNew Participant
asked in Censys Platform Q&A
Issue with API Query Results - Only First Page Saved in JSON

I recently upgraded my account to use the API after the recent platform update.I am using Windows CMD to run queries and successfully download the results as a JSON file.However I noticed that the JSON file only contains the first page of results, while the full query results are available when I run the same query on the website I would like to download the entire set of results as a JSON file. Could you please guide me on how to achieve this uising the API? curl -X "POST" "https://api.platform.censys.io/v3/global/search/query?organization_id=secret" --header "X-Organization-ID: secret" --header "Accept: application/json" --header "Authorization: secret" --header "Content-Type: application/json" -d "{\"query\":\"1.1.0.0\"}" > 1.1.json  

626
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 7, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Unauthenticated Auth Bypass Vulnerability in CrushFTP [CVE-2025-31161] Use the following queries to find CrushFTP services. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query ASM risk query This query can be used to identify exposed instances of CrushFTP that are vulnerable to the exploit. Unauthenticated RCE Vulnerability in Ivanti Connect & Policy Secure and ZTA Gateway [CVE-2025-22457] Use the following queries to find Ivanti Connect Secure services. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query ASM risk query This query can be used to identify exposed instances of Ivanti C

450
MattK_Censys
D
DenTNew Participant
asked in Search findings, use cases, and queries
The * symbol is not working

Good afternoon, the “*” symbol worked fine on the old platform, for example, I want to find cameras by a specific domain and make a request: “camera*.keenetic.*” at the same time, I get several hundred results (including cameravilla.keenetic.pro; camerahome.keenetic.link and many others), but when on a new platform I enter the same query “camera*.keenetic.*” I only get one response, for example: viagesu-camera.keenetic.link.The "*" sign is simply ignored in any combinations.At first, I thought these were temporary difficulties when switching to a new platform, but today I still could not adequately create a query so that the “*” symbol would work as indicated in the manual. 

698
R
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 2, 2025

The following enhancements and improvements are now available to Censys users.Censys PlatformUse Collections to track and monitor the results of a Censys query over time.  Save time and resources by creating a collection and configuring alerts to track new assets that match your queries.  Collections track both additions and subtractions to assets that match your queries. Configure collection webhooks to receive real-time alerts for any changes within your collections. Collections are currently available to Platform Starter users. Learn more about Collections in the Censys Academy. Censys ASMUse risk evidence to understand how Censys ASM detected a risk and determine whether a risk requires further validation before it is prioritized for remediation.  Risk evidence links directly to the scan data that includes the evidence for risk. This enables you to accelerate your investigations and use Censys data to find and close risks faster. Rapid ResponseThe Censys Rapid Response team pub

570
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for October 10, 2024: Using the new suspicious open directory label

Hey hey folks, this week I’ve got a query that leverages our new suspicious open directory label. While simply running labels: suspicious-open-dir can be a good starting point in general, combining it with other information of interest can get you really moving in an investigation. Try the following with hosts:labels: suspicious-open-dir and services.http.response.body: "cve"This will return hosts with the suspicious open directory label and “cve” in the service response body. Sub a different indicator of interest in there and take it away!This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

942
MattK_Censys
A
AAANew Participant
asked in Censys Platform Q&A
Redirection loop when login to Censys platform

I was trying to use censys platform but keep getting redirected between platform and the account page. Tried different browsers such as Firefox, Chrome etc. Cleared browser caches, cookies, incognito mode… all didn’t work.

692
A

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us