By default, Censys performs full-text searches. For example, searching for Dell will find any hosts where the word Dell appears in the record—it won't limit the search to Dell manufactured devices. However, this is possible by querying specific fields using the follow syntax:

Specifying Fields


Censys records are structured and allow querying specific fields. For example, you can search for all hosts with a specific HTTP status code with the following query: 80.http.get.status_code: 200. You can view a list of defined fields under the Data Definitions tab or by looking at the details of a host. For example, here are the fields for the Censys certificate.

Boolean Logic


You can compose multiple statements using the terms and, or, not, and parentheses. For example, ("Schneider Electric" or Dell) and 23.20.0.0/14. By default, all included terms are optional (i.e., executed as an or statement).

Ranges


You can search for ranges of numbers using [ and ] for inclusive ranges and { and } for exclusive ranges. For example, 80.http.get.status_code:[200 TO 300]. Dates should be formatted using the following syntax: [2012-01-01 TO 2012-12-31]. One sided limits can also be specified: [2012-01-01 TO *]. Warning! The TO operator must be capitalized.

Wildcards and Regular Expressions


By default, Censys searches for complete words. In other words, the search Del will not return records that contain the word Dell. Wildcard searches can be run on individual terms, using ? to replace a single character, and * to replace zero or more characters. For example, if you want to search for words that start with Del, you would search for Del*.

You can also search using regular expressions, e.g., metadata.manufacturer:/De[ll]/. The full regex syntax is available here.

Boosting


The boost operator (^) can be used to make one term more relevant than another. For example, metadata.manufacturer: Dell^2 OR "Schneider Electric" places more preference on the Dell keyword.

Reserved Characters


The following characters must be escaped with a backslash: + - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ /.

Below are a series of example queries:

Hosts in 23.0.0.0/8 and 8.8.8.0/24:


IPv4

Telnet and FTP hosts in Germany:


IPv4

Popular websites without browser trusted certificates:


Websites

Popular websites that use Apache and support HTTPS:


Websites

Mozilla NSS trusted intermediate CAs:


Certificates

Industrial Control Systems in the United States:


IPv4

Hosts in ASes that contain word University:


IPv4

1000–1010th most popular site per Alexa Top Million:


Websites

Trusted certificates for Github.com:


Certificates

If you're still running into problems constructing a query, try reaching out on the Censys Community Discussion.