Censys search

censys search 'services.service_name: HTTP'

Search Censys for internet-exposed hosts and services, querying the scanner index with structured queries.

Run it in the reconnaissance phase when you want the exposed surface with the Censys index: censys search queries the scanned hosts and services with structured queries (services, banners, certificates, protocols) and reports the results — IPs with services and metadata. It's the internet scanner with a focus on certificates and protocols (the Censys index). In recon, Censys gives the target's exposure — services, certificates (certificate domains), protocols — with index queries.

Don't use it as a complete inventory: the Censys index covers what it scans — active scanning complements it. The Censys API has limits (the plan): use it judiciously. And watch out: results need interpretation (host ownership, CDNs) and verification. For search without API, use the website; the CLI for the recon workflow. Shodan and Censys complement each other: each index has its own coverage.