--- updatedAt: 2025-03-12T13:10:30.000Z agentTools: projectIndex: https://docs.censys.com/llms.txt --- # Service Information The Legacy Search dataset features numerous service-related fields. They can be used to identify the applications and content present on hosts and virtual hosts. The following list is a short preview of the top-level, service-related fields present in the Legacy Search dataset. In addition to top-level service fields, there are hundreds of service fields organized by the specific service name (such as `services.ftp`, `services.dns`, `services.ssh`, `services.tls`, `services.http`, and so on). Example queries targeting service fields are provided below the table. The [data definitions table in the Legacy Search web app](https://search.censys.io/search/definitions?resource=host) provides a complete list of service fields. ## Example fields | Field | Type | | :------------------------------- | :------ | | `services` | nested | | `services.banner` | text | | `services.banner_hashes` | text | | `services.banner_hex` | text | | `services.discovery_method` | text | | `services.extended_service_name` | text | | `services.parsed` | object | | `services.perspective_id` | text | | `services.port` | integer | | `services.service_name` | text | | `services.source_ip` | ip | | `services.transport_protocol` | text | | `services.truncated` | boolean | ## Example queries | Query description | Legacy Search query | Run query in Legacy Search | | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Hosts emitting GNSS payloads | `services.banner: "$GPRMC"` | [Try it](https://search.censys.io/search?resource=hosts\&q=services.banner%3A+%22%24GPRMC%22\&ref=awesome-censys-queries) | | WinAQMS Environmental Monitor | `services.banner: "WinAQMS Data Server" and services.truncated: false` | [Try it](https://search.censys.io/search?resource=hosts\&q=services.banner%3A+%22WinAQMS+Data+Server%22+and+services.truncated%3A+false\&ref=awesome-censys-queries) | | Honeypot Hosts | `services.truncated: true` | [Try it](https://search.censys.io/search?resource=hosts\&q=services.truncated%3A+true\&ref=awesome-censys-queries) | | Return hosts that are running an HTTP service on port 8888 | `services: (port: 8888 and service_name: HTTP)` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=25\&virtual_hosts=EXCLUDE\&q=services%3A+%28port%3A+8888+and+service_name%3A+HTTP%29) | | Compromised MikroTik Routers | `services.service_name: MIKROTIK_BW and "HACKED"` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=100\&virtual_hosts=INCLUDE\&q=services.service_name%3A+MIKROTIK_BW+and+%E2%80%9CHACKED%E2%80%9D) | | Services on port 53 that are not DNS | `services: (port: 53 and not service_name: DNS) and services.truncated: false` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=100\&virtual_hosts=INCLUDE\&q=services%3A+%28port%3A+53+and+not+service_name%3A+DNS%29+and+truncated%3A+false) | | Return hosts with port 443 open (with any service type) and an HTTP service (on any port). Note that search criteria applies to a host or certificate as a whole, unless specified. This query returns hosts with any service on port 443 and HTTP on any port. | `services.port: 443 and services.service_name: HTTP` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=25\&virtual_hosts=EXCLUDE\&q=+services.port%3A+443+and+services.service_name%3A+HTTP) | | Search for hosts that have any of the following ports open: 22, 23, 24, 25 | `services.port: {22, 23, 24, 25}` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=100\&virtual_hosts=INCLUDE\&q=services.port%3A+%7B22%2C+23%2C+24%2C+25%7D) | | Find hosts running SSH on a non-standard port, for example, neither 22 nor 2222 | `services: (service_name: SSH and not port: {22, 2222})` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=25\&virtual_hosts=EXCLUDE\&q=services%3A%28service_name%3A+SSH+and+not+port%3A+%7B22%2C+2222%7D%29) | | Network devices with exposed login pages | `services: (labels:{network.device, login-page})` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=100\&virtual_hosts=INCLUDE\&q=services%3A+%28labels%3A%7Bnetwork.device%2C+login-page%7D%29) | | Search for hosts that have at least one non-HTTP service | `services: (not service_name: HTTP)` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=100\&virtual_hosts=INCLUDE\&q=services%3A+%28not+service_name%3A+HTTP%29+and+truncated%3A+false) | | Find hosts running a specific service | `services.service_name: SSH` | [Try it](https://search.censys.io/search?resource=hosts\&q=services.service_name%3A%20SSH\&ref=questions) | | Search for hosts that have no HTTP services | `not services.service_name: HTTP` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=100\&virtual_hosts=INCLUDE\&q=not+services.service_name%3A+HTTP+and+truncated%3A+false) | | Search for hosts with services that Censys Scanners last observed within NTT and TELIA ISPs | `services.perspective_id: "PERSPECTIVE_NTT" and services.perspective_id: "PERSPECTIVE_TELIA"` | [Try it](https://search.censys.io/search?resource=hosts\&sort=RELEVANCE\&per_page=100\&virtual_hosts=INCLUDE\&q=services.perspective_id%3A+%22PERSPECTIVE_NTT%22+and+services.perspective_id%3A+%22PERSPECTIVE_TELIA%22) | | Find ATG servers | `services.service_name: ATG` | [Try it](https://search.censys.io/search?resource=hosts\&q=services.service_name%3A%20ATG\&ref=questions) | | Find Cobalt Strike servers | `services.service_name: COBALT_STRIKE` | [Try it](https://search.censys.io/search?resource=hosts\&q=services.service_name%3A%20COBALT_STRIKE\&ref=questions) | | Find hosts running software from a specific country | `location.country: Russia and services.software.product: gSOAP` | [Try it](https://search.censys.io/search?resource=hosts\&q=location.country%3A%20Russia%20and%20services.software.product%3A%20gSOAP\&ref=questions) | | Find hosts with a specific port open | `services.port: 22` | [Try it](https://search.censys.io/search?resource=hosts\&q=services.port%3A%2022\&ref=questions) | | Services listening on Port 22 that are not SSH | `same_service(services.port: 22 and not services.service_name: {SSH} and not services.banner: {"Connection refused", "SSH-", "Exceeded MaxStartups", "Too many users", "Connection closed by server"}) and services.truncated: false` | [Try it](https://search.censys.io/search?resource=hosts\&q=same_service\(not+services.service_name%3A+%7BSSH%7D+and+services.port%3A+22+and+not+services.banner%3A+%7B%22Connection+refused%22%2C+%22SSH-%22%2C+%22Exceeded+MaxStartups%22%2C+%22Too+many+users%22%2C+%22Connection+closed+by+server%22%7D\)+and+services.truncated%3A+false\&ref=awesome-censys-queries) | | Find hosts with a specific service on a specific port | `service: (port: 22 and service_name: SSH)` | [Try it](https://search.censys.io/search/language?resource=hosts\&q=service%3A+%28port%3A+22+and+service_name%3A+SSH%29\&ref=questions) | | Busybox Shells | `same_service(services.banner: "Enter 'help' for a list of built-in commands" and services.service_name: TELNET) and services.truncated: false)` | [Try it](https://search.censys.io/search?resource=hosts\&q=same_service%28services.banner%3A+%22Enter+%27help%27+for+a+list+of+built-in+commands%22+and+services.service_name%3A+TELNET%29+and+services.truncated%3A+false\&ref=awesome-censys-queries) | | Counter-Strike: Global Offensive | `same_service(banner: "Counter-Strike: Global Offensive Server" and service_name: VALVE)"` | [Try it](https://search.censys.io/search?resource=hosts\&q=same_service%28banner%3A+%22Counter-Strike%3A+Global+Offensive+Server%22+and+service_name%3A+VALVE%29\&ref=awesome-censys-queries) |