Reference

Search Query Syntax

The search box speaks a structured, boolean query language. Combine typed field filters with AND/OR/NOT, ranges, sets, comparisons, regular expressions, and geo radius to pinpoint exactly the hosts and services you want. Every example below is clickable — run it to see live results.

← Back to search Field catalog as JSON →
http.statusfield — what to match :>=operator 400value

A query is built from clauses like the one above. Stack several with spaces and a host must match all of them. Mix in OR, NOT, and parentheses to go further.

Examples marked with a link icon are live — click any one to run it.

Combining terms

Terms join with an implicit AND. Use these to broaden, narrow, or group them.

a b
AND (implicit)
Separate terms with spaces; every term must match. This is the default — no keyword needed.
product:nginx country:DE
a OR b
OR
Match either side. OR binds looser than the implicit AND, so group with parentheses when mixing.
product:nginx OR product:apache
-a · NOT a
NOT / exclude
Drop hosts that match the term. The leading-dash and NOT forms are equivalent.
port:443 -country:USNOT tag:cloud
( … )
Grouping
Parentheses control precedence so you can combine OR and AND unambiguously.
(product:apache OR product:nginx) country:US
wordpress
Free text
A bare word with no field: searches across product, HTTP title, banner, HTML body, parsed extras, game MOTD, and org name.
wordpress"remote desktop"

Matching values

A single field:value clause can be expressed many ways.

field:value
Match
Text fields match a case-insensitive substring; keyword/number fields match exactly.
org:cloudflarecountry:US
field:"a phrase"
Quoted phrase
Wrap values containing spaces or special characters in double quotes.
city:"san francisco"http.title:"login portal"
field:val*
Wildcard
Use * inside a value as a multi-character wildcard.
tls.cert.san:*.example.com
field:*
Exists
A bare * matches any host where the field is present and non-empty.
http.title:*vuln:*
field:[a TO b]
Inclusive range
Numeric and datetime ranges. Use * for an open end.
port:[1 TO 1024]last_seen:[2026-01-01 TO *]
field:a-b
Numeric range (shorthand)
A compact inclusive range for numeric fields like port.
port:8000-8100
field:{a,b,c}
Set (any of)
Match any value in the set — shorthand for OR-ing several values of one field.
port:{80,443,8080}
field:>=n
Comparison
Open-ended comparisons with >, >=, <, <= for numbers and dates.
http.status:>=400last_seen:>2026-01-01
field:/regex/
Regular expression
Match the field value against a regular expression.
http.title:/admin.*/hostname:/^mail\d+/
geo:lat,lon,km
Geo radius
Find hosts within a radius (kilometres) of a coordinate.
geo:37.77,-122.42,50
sort:field:dir
Sort
Order results by last_seen, first_seen, port, or players — ascending or descending.
sort:port:ascsort:last_seen:descsort:players:desc

Worked examples

Real queries that combine several features. Click to run.

product:nginx country:DE nginx web servers located in Germany. port:{80,443,8080} org:cloudflare Common web ports announced by Cloudflare. http.status:[500 TO 599] Services currently returning a 5xx server error. (product:apache OR product:nginx) vuln:* Apache or nginx hosts with at least one known CVE. http.body:"wp-content" http.status:200 Live WordPress sites (HTML body match). tls.cert.subject:/.*\.gov/ country:US US hosts whose TLS certificate CN ends in .gov. geo:48.85,2.35,25 port:22 SSH services within 25 km of Paris. asn:15169 -http.title:* sort:last_seen:desc Recently-seen Google hosts that serve no HTML title.

Field reference

Every searchable field, its aliases, value type, and examples.

Value types text substring, case-insensitive keyword exact match number numeric, supports ranges datetime date, supports ranges ip address or CIDR geo lat,lon,radius hash fingerprint
Location & network Where a host lives on the internet.
ip ip aka net, cidr
IP address or CIDR the service is on.
net:1.1.1.0/24ip:8.8.8.8
asn number aka as
Origin autonomous system number.
asn:15169as:13335
org text aka isp, as_name
Autonomous system / org name.
org:cloudflare
country keyword aka cc
ISO-3166 country code.
country:US
city text
Host city.
city:"san francisco"
geo geo aka location, coords
Radius search: lat,lon,radius_km.
geo:37.77,-122.42,50
os text
Guessed operating system.
os:ubuntu
Names & DNS Hostnames and domains tied to a host.
hostname text aka host
Forward/reverse DNS name on the host.
hostname:example.com
domain text aka subdomain, fqdn, dns
DNS name (from certs/forward DNS) resolving to the host; matches the apex zone and its subdomains.
domain:example.comsubdomain:api.example.com
Classification Labels, products, and known issues.
tag text aka label
Host/service tag.
tag:cloud
cpe text
CPE product identifier.
cpe:nginx
vuln text aka cve
Associated vulnerability id.
vuln:CVE-2021-44228
source keyword
Data source (scan, internetdb, ...).
source:scan
Time When a service was observed.
first_seen datetime
When the service was first observed.
first_seen:<2025-01-01
last_seen datetime aka seen
When the service was last observed.
last_seen:>2026-01-01last_seen:[2026-01-01 TO *]
Service The listening service itself.
port number
Service port (supports ranges/sets).
port:443port:[1 TO 1024]port:{80,443,8080}
transport keyword
tcp or udp.
transport:udp
protocol keyword aka proto
Application protocol.
protocol:https
product text aka app
Detected product/software.
product:nginx
version keyword
Detected product version.
version:1.18.0
vendor text
Detected vendor.
vendor:apache
banner text aka data
Raw service banner text.
banner:"SSH-2.0"
extra text aka service.extra
Protocol-specific parsed data (Minecraft players/version, NTP version, DNS version.bind, game-server query).
extra:minecraftextra:"\"online\":"
players.online number aka players, mc.players
Current player count on a game server that advertises one (Minecraft SLP).
players.online:>0players:[10 TO *]
players.max number aka players.slots
Advertised max player slots on a game server.
players.max:>=100
motd text aka game.motd
Game server description / MOTD (color-code-stripped display text).
motd:survivalmotd:"welcome to"
HTTP Web-response details.
http.status number aka status
HTTP response status code.
http.status:200http.status:[500 TO 599]
http.title text aka title
HTML <title>.
http.title:login
http.server text aka server
HTTP Server header.
http.server:nginx
http.body text aka http.html, html, body
HTTP response body / HTML content.
http.body:"powered by wordpress"
http.favicon.hash number aka favicon
MurmurHash3 of the favicon.
http.favicon.hash:-12345678
TLS & fingerprints Certificates and protocol fingerprints.
tls.cert.subject text aka cert.subject
TLS cert subject CN.
tls.cert.subject:example.com
tls.cert.issuer text aka cert.issuer
TLS cert issuer CN.
tls.cert.issuer:"Let's Encrypt"
tls.cert.san text aka cert.san
TLS cert subject alternative name.
tls.cert.san:*.example.com
cert hash aka tls.cert.sha256, ssl.cert
TLS cert SHA-256 fingerprint.
cert:abcd...ef
tls.version keyword
Negotiated TLS version.
tls.version:TLSv1.3
jarm text aka tls.jarm
JARM TLS fingerprint.
jarm:2ad...
ja3s text aka tls.ja3s
JA3S server fingerprint.
ja3s:51c...
ssh.fingerprint text aka ssh.hassh
SSH host-key fingerprint.
ssh.fingerprint:SHA256:...
Result control Shape the result set.
sort keyword
Result ordering: last_seen|first_seen|port|players[:asc|desc].
sort:port:ascsort:players:desc
← Back to search