You can search for records that meet certain criteria (e.g., IPv4 hosts in Germany manufactured by Siemens, or browser trusted certificates for github.com), generate reports on how websites are configured (e.g., what cipher suites are chosen by popular websites?), and track how networks have patched over time.
If you simply search for a word or phrase,
Censys will return any records that contain the phrase. For example, searching
nginx will return any records that contain the word nginx.
18.104.22.168/8 will return all hosts in that
network. Check out some of our example searches.
Censys data is structured and supports more
advanced queries including searching specific fields, specifying ranges of
values, and boolean logic. For example, you can search for hosts with the HTTP
Server Header "Apache" in Germany by running the query
80.http.get.headers.server: Apache and location.country_code: DE.
To facilitate complex questions that can't be expressed in a single search, we also allow researchers to run SQL queries against the raw datasets and historical snapshots. [more information]
By default, Censys performs full-text searches. For example, searching for
Dell will find any hosts where the word Dell appears in the
record—it won't limit the search to Dell manufactured devices. However, this is possible
by querying specific fields using the follow syntax:
Censys records are structured and allow
querying specific fields. For example, you can search for all hosts with a
specific HTTP status code with the following query:
200. You can view a list of defined fields under the Data
Definitions tab or by looking at the details of a host.
For example, here are the fields for the Censys web server.
You can compose multiple statements using the terms
not, and parentheses. For example,
("Schneider Electric" or Dell) and 22.214.171.124/14. By
default, all included terms are optional (i.e., executed as an
Networks, Host Names, and Protocols
You can search for IP
addresses using CIDR notation (e.g.,
ip:126.96.36.199/14) or by specifying a range of addresses:
ip:[188.8.131.52 TO 184.108.40.206]. You can search for
hosts that serve a particular protocol by searching the protocols field, e.g.,
You can search for ranges of numbers using
for inclusive ranges and
} for exclusive
ranges. For example,
80.http.get.status_code:[200 TO 300].
Dates should be formatted using the following syntax:
TO 2012-12-31]. One sided limits can also be specified:
[2012-01-01 TO *]. Warning!
TO operator must be capitalized.
Wildcards and Regular Expressions
By default, Censys searches for complete words. In other words, the search
Del will not return records that contain the word
Wildcard searches can be run on individual terms, using
replace a single character, and
* to replace zero or more
characters. For example, if you want to search for words that start with
Del, you would search for
You can also search using regular expressions, e.g.,
metadata.manufacturer:/De[ll]/. The full regex syntax is available
The boost operator (
^) can be used to
make one term more relevant than another. For example,
metadata.manufacturer: Dell^2 OR "Schneider Electric" places more
preference on the Dell keyword.
The following characters must be escaped with a backslash:
Below are a series of example queries:
Hosts in 220.127.116.11/8 and 18.104.22.168/24:
Telnet and FTP hosts in Germany:
Popular websites without browser trusted certificates:
Popular websites that use Apache and support HTTPS:
Mozilla NSS trusted intermediate CAs:
Industrial Control Systems in the United States:
Hosts in ASes that contain word University:
1000–1010th most popular site per Alexa Top Million:
Trusted certificates for Github.com:
Below are the fields defined in the index.
- IPv4 Hosts
- Top Million Websites
Your query ("known-private-key") found 1,442,947 IPv4 hosts.
Country Hosts Frequency United States 198,796 13.78% Thailand 156,653 10.86% Brazil 151,969 10.53% United Kingdom 98,307 6.81% Dominican Republic 94,042 6.52% Colombia 93,758 6.5% Panama 62,529 4.33% Spain 61,579 4.27% Canada 43,144 2.99% Russia 36,924 2.56%
Autonomous System (AS) Hosts Frequency Compaa Dominicana de Telfonos, C. por A. - CODETEL, DO 93,985 6.51% JASTEL-NETWORK-TH-AP JasTel Network International Gateway, TH 93,444 6.48% COLOMBIA TELECOMUNICACIONES S.A. ESP, CO 62,709 4.35% Cable & Wireless Panama, PA 62,215 4.31% CENTURYLINK-US-LEGACY-QWEST - Qwest Communications Company, LLC, US 61,783 4.28% VODAFONE_ES, ES 42,645 2.96% TRIPLETNET-AS-AP Triple T Internet/Triple T Broadband, TH 34,064 2.36% EMPRESAS MUNICIPALES DE CALI E.I.C.E. E.S.P., CO 29,312 2.03% BARR-XPLR-ASN - Xplornet Communications Inc., CA 25,663 1.78% TOT-NET TOT Public Company Limited, TH 24,937 1.73%
Tag Hosts Frequency https 1,442,947 100.0% known-private-key 1,442,947 100.0% http 299,095 20.73% cwmp 137,120 9.5% ssh 119,656 8.29% telnet 75,747 5.25% ftp 72,546 5.03% rsa-export 60,881 4.22% dhe-export 55,059 3.82% Update utility 9,810 0.68%