Example Host Queries in Censys Search Language

Use these example queries to learn about the Censys Search Language and the searchable data available for hosts. For more information about search syntax, see Censys Query Language Syntax.

Censys Search Language Examples

The table below provides working queries you can use to learn the Censys Search Language for querying hosts.

The first column is the Censys Search Language showcased in the query. The second column describes the query. The third column is the query syntax, linked to the Results page on search.censys.io.

Search Type	Description	Link	Query
Full Text Search	Search for hosts whose parsed data contains the word hello	Try it	`hello`
Full Text Search	Search for hosts whose parsed data contains the words hello and world although not necessarily together	Try it	`hello world`
Full Text Search	Search for hosts whose parsed data contains the phrase hello world	Try it	`"hello world"`
Field:Value Pairs	Search for hosts with an HTTP service whose HTML title indicates it is exposing a directory	Try it	`services.http.response.html_title: "Index of /"`
Exact Match Operator	Search for hosts with an HTTP service whose hashed body content indicates that it is a Brute Ratel C4 server	Try it	`services.http.response.body_hash="sha1:1a279f5df4103743b823ec2a6a08436fdf63fe30"`
Boolean Logic	Search for hosts in the U.S. with any reference to the string "teslamate"	Try it	`(teslamate) and location.country=`United States
Set Operator	Search for hosts that have any of the following ports open: 22, 23, 24, 25	Try it	`services.port: {22, 23, 24, 25}`
Boolean Logic	Search for hosts that have no HTTP services	Try it	`not services.service_name: HTTP`
Boolean Logic	Search for hosts that have at least 1 non-HTTP service	Try it	`services: (not service_name: HTTP)`
Wildcards	Search for hosts with at least 1 service presenting a certificate during a TLS handshake	Try it	`services.tls.certificate.fingerprint_sha256: *`
Regular Expressions (Paid users only)	Search for hosts presenting certificates with a name foo1, foo2, foo3…foo100 followed by any value	Try it	`services.tls.certificate.names=/foo<1-100>.*/`
Relative time	Search for hosts updated in the past hour	Try it	`last_updated_at: [now-1h TO *]`
Relative time	Search for CVEs with a KEV added in the past 6 months	Try it	`cves.kev.date_added: [now-6M TO *]`
Ranges	Search for hosts whose IP address falls within the specified range	Try it	`ip: [1.12.0.0 to 1.15.255.255]`
Ranges	Search for hosts whose location is within a box specified by its geographic coordinates Tip Draw a box on this map and open Search with the coordinate ranges populated.	Try it	`location.coordinates.latitude: [31.2221970321032 to 31.596082850911525] and location.coordinates.longitude: [34.16473388671876 to 34.58908081054688]`
Nested field queries	Search for hosts running the SSH protocol on ports other than 22 and 2222	Try it	`services:(service_name: SSH and not (port: {22, 2222}))`
Nested field queries	Search for hosts running Elasticsearch on port 443	Try it	`services: (service_name: ELASTICSEARCH and port: 443)`

Host Attribute Examples

The table provides working queries you can use to learn about the data model of hosts.

The first column shows the top-level host attribute showcased in the query. The second column describes the query. The third column is the query syntax, linked to the Results page on search.censys.io.

Some of these examples were gathered from community resources like this!

Host Attribute

Description

Link

Query

Perspective

Search for hosts with services that were last observed by Censys Scanners within NTT and TELIA ISPs

Try it

services.perspective_id: "PERSPECTIVE_NTT" and services.perspective_id: "PERSPECTIVE_TELIA"

Web Servers

Search for hosts with a page title on the HTTP service containing the word "dashboard"

Try it