Tags created by Censys are called labels. You can use these labels to refine your search across hosts, services, and certificates.

Using labels to refine your search

Searching with labels

To search using a label, use the format labels=label value.

In the left side of Censys Search, click a label to filter your search:

See the tables below for the labels available while searching hosts or certificates.

Label	Definition
`database`	This service is a database
`email`	This service is an email protocol
`file-sharing`	This service is used for file sharing
`iot`	This service is an IoT protocol
`login-page`	This HTTP service is serving a login page
`network-administration`	This service is a network administration protocol
`network.device`	The software reported by this service indicates that it is a network management device
`network.device.firewall`	The software reported by this service indicates that it is used for managing a firewall
`network.device.soho`	The software reported by this service indicates that it is used for managing the networks of small offices/home offices
`network.device.vpn`	The software reported by this service indicates that it is used for VPN termination
`network.device.web-ui`	The software reported by this service indicates that it is used for VPN termination
`onion-enabled`	The HTTP service returned an Onion header as part of its response
`out-of-band-management`	The software reported by this service indicates that is one belonging to a self-described category of remote server management technologies
`remote-access`	This service enables remote access
`scada`	This service is an industrial control protocol
`voip`	This service is a VoIP protocol
`web.control-panel.hosting`	The software reported by this service indicates that it is a control panel interface for web host management

Labels related to validation, such as trusted and revoked, are current as of the certificate record validated_at timestamp.

Label	Definition
`root`	A root certificate
`intermediate`	An intermediate certificate
`leaf`	A leaf certificate
`ct`	Published to a certificate transparency log
`google-ct`	Published to a certificate transparency log operated by Google
`precert`	A pre-certificate
`expired`	Certificate is expired
`unexpired`	Certificate is not expired
`redacted`	Some of the certificate’s names contain redacted fields
`revoked`	The certificate’s trust is revoked by its issuer
`self-signed`	The certificate is self-signed
`trusted`	The certificate is valid
`untrusted`	The certificate is not valid
`ever-trusted`	The certificate is valid now or was valid in the past
`was-trusted`	The certificate is not valid now but was valid in the past
`unparsable`	The certificate’s contents could not be parsed
`dv`	A Domain Validated certificate
`ov`	An Organization Validated certificate
`ev`	An Extended Validation certificate