Hosts

The Legacy Search host dataset provides accurate, up-to-date records that reflect the reality of public IPv4 and IPv6 hosts and virtual hosts (host services reached by name).

Host records

An IP address identifies hosts.

The Censys model of Internet hosts contains more than just service data observed in scanning. Censys also enriches hosts with quality data from third parties to provide information such as geographical location, network routing information, DNS names, and so on.

A name and IP tuple identifies virtual hosts. Learn more about virtual hosts.

Host fields

The data definitions for hosts list every field that can appear in a host or virtual host record.

Top-level host fields

Top-level host fields include information that applies to the host as a whole, such as its geographic location, network routing information, DNS names, operating system, and labels, as well as a repeated record of services observed in the scan.

Quick links to the top-level fields in a host record:

Service fields

Service records contain identification and metadata fields, labels for easy searching, and a protocol-specific sub-record with information parsed from the scan, TLS fields, and software fields.

Identification and observation fields

Identifying service information includes fields like:

Service name: The name of the service. Correlates loosely to OSI Layer 7 protocol names.
Port: The port used by the service.
Extended service name: The name of the service, including the TLS indicator, if the service negotiated a TLS connection.
Transport protocol: The name of the transport protocol. Correlates to OSI Layer 4 protocols (for example, TCP, UDP, QUIC).
Truncated: Whether the service data was truncated because it is a suspected low-value pseudo-service on a superhost.

Observation information consists of fields that provide data about the Censys discovery and observation of the service:

Perspective ID: The name of the ISP that Censys peered with when it observed the service as represented.
Source IP: The IP address of the Censys scanner when it observed the service represented.
Discovery method: The name of the method that led to the discovery of the service by a Censys scanner.

Service-name-specific fields

The data Censys observes about an HTTP service is very different from that of an SSH service, so the parsed data from each scan is searchable within a record that matches the service name.

The fields found in each service-name-specific field (such as SSH, TELNET, SNMP, and so on) reflect the details of that protocol.

Software fields

Within each service object, a software array shows software information in the Common Platform Enumeration (CPE) version 2.3 format.

Example Host Record (JSON)

{
  "ip": "198.108.0.1",
  "last_updated_at": "2022-01-24T16:29:00.614Z",
  "location": {
    "city": "Ann Arbor",
    ...
  },
  "location_updated_at": "2022-01-24T16:29:00.605583Z",
  "autonomous_system": {
    "asn": 237,
    "name": "MERIT-AS-14",
    ...
  },
  "autonomous_system_updated_at": "2022-01-22T07:29:48.507740Z",
  "dns": {
    "names": [
      "irbx4.sfdata-qfx1.mich.net"
    ],
    "records": {
      "irbx4.sfdata-qfx1.mich.net": {
        "record_type": "A",
        "resolved_at": "2021-12-29T15:37:59.169926191Z"
      }
    }
  },
  "services": [
    {
      "service_name": "BGP",
      "extended_service_name": "BGP",
      "transport_protocol": "TCP",
      "port": 179,
      "observed_at": "2022-01-24T16:28:59.485091355Z",
      ...
    }
  ]
}

CVE fields

Manage vulnerabilities and monitor your threat landscape with searchable Common Vulnerabilities and Exposures (CVEs) in your host dataset using Legacy Search. Censys CVE data enriches host data with known CVE information for operating systems, software, and hardware.

Learn more about CVEs in Legacy Search here.