Third-Party Data Context
Censys partners with several other data providers to give further context of the scan data present in the Censys Platform to enable you to make more informed decisions during alert triage, incident response, and threat investigation. These partners include GreyNoise, IPinfo, Mallory, and Onionoo.
Context data is added to assets in the Platform and can be viewed and searched across in the web UI and via the API.
Some contextual data from IPinfo is leveraged in host reputation score calculations, however be aware there may be some hosts that have been tagged as "Malicious" by GreyNoise and Mallory yet the Reputation Score might show it as benign. Any host deemed to be malicious by GreyNoise and Mallory will be reflected in the Reputation Score in Q3 2026.
The contextual data described on this page is only available to Censys Core customers.
Contextual data in the UI
Contextual data for an asset is shown on the Enrichments and Raw Data tabs. See the provider-specific contextual information below to learn where this data is present in the Censys data schema.
Click the JSON tab to see enrichment data in JSON format.
Third-Party Data Providers
GreyNoise
GreyNoise is a cybersecurity platform that collects and analyzes internet-wide scan and attack traffic. GreyNoise tags and classifications are available on hosts in the Censys Platform.
GreyNoise data in Censys
The following objects and fields contain GreyNoise contextual data.
| Field or object name | Description |
|---|---|
host.greynoise | The object containing GreyNoise data. |
host.greynoise.classification | The GreyNoise classification for the IP address. Values include unknown, benign, suspicious, and malicious. |
host.greynoise.tags | The GreyNoise tags for the IP address. |
host.greynoise.tags.name | The name of the GreyNoise tag. |
host.greynoise.actor | The actor that was observed. |
host.greynoise.last_observed_time | When the host was last scanned by GreyNoise. |
IPinfo
IPinfo helps security teams understand and classify IP addresses with geolocation, ASN, privacy, and network intelligence. IPinfo data is used to give context on several components of the Censys Platform host dataset. IPinfo's Privacy Detection data is highlighted on the Enrichments tab in the Platform UI and displayed in the privacy data object on hosts.
IPinfo's privacy data contains information about whether a host features anonymization infrastructure like VPNs, proxies, relays, and Tor exit nodes.
IPinfo privacy data in Censys
IPinfo privacy data is contained in the host.privacy object.
IPinfo VPN, privacy, and Tor detections help determine whether anonymization infrastructure is present on a host for calculating reputation scores.
Mallory
Mallory is an AI-native threat intelligence aggregator that monitors global threat signals.
Mallory data in Censys
Mallory data is contained in the host.privacy object.
Onionoo
Onionoo is a Tor Project that provides structured data about current Tor relays and bridges so security teams can analyze Tor network statuses.
Onionoo data in Censys
Onionioo Tor data is contained in the host.privacy object.