Censys Review

What Censys Is

Censys scans all IPv4 addresses and collects certificate transparency logs. The result is a searchable index of internet-exposed hosts, services, and TLS certificates. Censys covers 1,400+ protocols. It ties host data to certificate chains, BGP prefixes, and autonomous systems in one data model.

Certificates are a core data type. You can find every certificate ever issued for a domain, including expired and revoked ones. You can move from certificate to host in a query. Operators sometimes miss things, and certificates expire.

What It's Good For

Censys excels in several areas. Censys is useful for certificate pivot investigations, finding every host that served a suspicious TLS cert, which is useful for tracking down malware C2Cs. The platform allows for tracking certificate reuse, building a fingerprint from one host, and finding the rest of the cluster. Censys enables enumerating services on a target ASN, providing a full picture of what an organization exposes, without needing direct contact. The service facilitates subdomain discovery by querying Censys's certificate index, finding subdomains not in DNS. Censys supports academic research by publishing its scanning method, making data access citation-ready, a defensible data source.

Getting Started

The Community tier is free, offering 250 queries per month, which is sufficient to test the tool or verify a lead.

The Individual plan costs $99 per month, providing 2,000 queries and API access from a single IP address. Students and academics can receive a higher quota by using their .edu email address.

Initial queries to consider:

# Find all hosts sharing a specific TLS certificate fingerprint (SHA-256)
services.tls.certificates.leaf_data.fingerprint: "a3f1..."

# Find all hosts in an ASN serving HTTPS
autonomous_system.asn: 15169 and services.port: 443

# Find all certificates issued to a domain, including subdomains
parsed.names: "*.target.com"

# Find SSH services running on non-standard ports
services.transport_protocol: "TCP" and services.service_name: "SSH" and not services.port: 22

# Find hosts with expired certificates still being served
services.tls.certificates.leaf_data.subject.organization: "Acme Corp" and services.tls.certificates.leaf_data.validity.end < "2025-01-01"

Censys Query Filters

Censys queries use dot notation. Fields are specified like services.port, metadata.title. Refer to the Censys Search Language documentation for field names and syntax.

Pricing

Most analysts begin with the $99/mo Individual plan, which works well for solo work. If you find yourself scripting bulk lookups or hitting query limits, consider stepping up to the Teams plan, which costs $399/mo.

Limitations

• Free tier limitations: 250 queries per month is not enough for real work. A single certificate pivot investigation can consume 50–100 queries in an hour.
• Shodan is cheaper for device and IoT recon: Shodan's individual plan is $69/mo, and it has more device-type tagging and better ICS/SCADA coverage.
• Query syntax requires investment: Censys's dot-notation field paths are precise but not guessable. Budget time with the documentation to learn the syntax.
• Historical data is paywalled: The free and individual tiers only show current data. Historical snapshots require a paid tier.

Alternatives

• Shodan: Broader device and IoT/ICS banner coverage, lower entry price, and more intuitive query syntax. Choose Shodan for device fingerprinting, ICS discovery, or bulk banner analysis.
• FOFA: China-based scanner with cheaper pricing and strong coverage of Asian IP space. Choose FOFA for higher query volume at lower cost and targets concentrated in Asia-Pacific.
• ZoomEye: Similar indexing approach to Censys with a more generous free tier. Choose ZoomEye for lightweight investigations where budget is a constraint and cert work isn't the priority.
• GreyNoise: Focused on filtering scanner noise rather than building an infrastructure map. Choose GreyNoise to classify whether an IP is a known scanner.

Verdict

Censys excels in certificate transparency. Its strength lies in CT logs, which enable cert reuse and subdomain discovery. The Individual tier costs $99/mo, a significant investment. The Academic tier is free for holders of .edu email addresses, making it an attractive option.

If you track devices or IoT, Shodan may be a more affordable choice at $69/mo, offering greater value for the price.

See Also

Best Threat Hunting Tools

Threat hunting requires a proactive approach. You're searching for adversaries hiding in the shadows of your network. Effective threat hunting tools help.

1. Shodan

Shodan indexes internet infrastructure, including servers, cameras, routers, industrial control systems. Anything listening on an open port gets catalogued. Banners tell you what's running, version numbers, sometimes config details. The OSINT value is that you know what a target has exposed before you ever send a packet their way. Operators miss things; dev servers get forgotten.

Shodan's query syntax is precise. You filter by port, protocol, or banner text. Results are exportable. API access lets you automate searches. It's a skill to learn, but Shodan pays off.

2. Censys

Censys scans the internet. It finds devices and services. Certificates reveal domain names. You get detailed info on TLS configurations. Port scans are fast. Censys focuses on security.

Censys and Shodan overlap. Each has unique data, such as Shodan, Censys. You use both for comprehensive coverage.

3. MISP

MISP aggregates and shares indicators. You correlate data from multiple sources. Visualizations help with analysis. MISP integrates with tools.

MISP centralizes data. You feed it intel. It shares it across your team.

4. Maltego

Maltego visualizes relationships. Domains, IPs, and hashes connect in a graph. You see the attack surface. Maltego supports investigations. You map out attacker infrastructure. Maltego's transform engine does the heavy lifting.

5. SpiderFoot

SpiderFoot automates OSINT collection. It scrapes data from public sources. You monitor domains, IPs, and hashes. SpiderFoot gathers data fast. SpiderFoot supports multiple data sources.

SpiderFoot is a timesaver. You focus on analysis.

Comparison of Threat Hunting Tools

The comparison of threat hunting tools shows the following: Shodan focuses on network recon, with internet scans as its data source, high automation, and a steep learning curve. Censys focuses on network recon, with internet scans as its data source, high automation, and a steep learning curve. MISP focuses on threat intel, with aggregated feeds as its data source, medium automation, and a moderate learning curve. Maltego focuses on entity analysis, with a graph DB as its data source, medium automation, and a moderate learning curve. SpiderFoot focuses on OSINT collection, with public sources as its data source, high automation, and an easy learning curve.

Best Network Recon Tools

Network recon tools find what's exposed. You identify attack surfaces.

1. Nmap

Nmap scans networks. Fast and accurate. You detect hosts, services. Nmap's scripting engine extends capability. You write scripts; Nmap automates tasks.

2. Masscan

Masscan scans the internet. You detect hosts. Results are raw. Masscan serves different needs. Masscan's speed comes at the cost of detail.

3. ZMap

ZMap scans networks. Open-source. You detect hosts, services. ZMap's design focuses on speed. It scans large networks fast. Results are detailed.

Comparison of Network Recon Tools

The comparison of network recon tools shows the following: Nmap has medium speed, high accuracy, and high automation. Masscan has high speed, low accuracy, and medium automation. ZMap has high speed, high accuracy, and medium automation.

Conclusion

Threat hunting and network recon require the right tools. Shodan, Censys, Nmap are top tools. Each tool has strengths. You choose based on your needs.

Further Reading

• Censys internet search
• Censys documentation