General Rules The search scope covers devices (IPv4, IPv6) and websites (domain names). When entering a search string, the system matches keywords in global mode, covering content from various protocols such as HTTP, SSH, FTP, etc. Search strings are case-insensitive by default and are matched after segmentation. Use == for exact matching with case sensitivity. Always use quotation marks for search strings, e.g., "Cisco System". Use backslashes to escape characters if needed, e.g., "a\"b" or portinfo(). Search Logic Operations = β Search for assets containing the keyword Example: title="knownsec" == β Exact match (case-sensitive), supports empty values Example: title=="knownsec" || β Logical OR Example: service="ssh" || service="http" && β Logical AND Example: device="router" && after="2020-01-01" != β Logical NOT Example: country="US" && subdivisions!="new york" () β Priority grouping Example: (country="US" && port!=80) || (country="US" && title!="404 Not Found")
β Fuzzy search Example: title="google*" Geographical Location Search country="CN" β Search assets by country (use abbreviation or name, e.g. country="china") subdivisions="beijing" β Search assets by administrative region (input in English) city="changsha" β Search assets by city (input in English) Certificate Search ssl="google" β Search for assets with string in SSL certificate (e.g., product/company name) ssl.cert.fingerprint="β¦" β Search by certificate fingerprint ssl.chain_count=3 β Search assets with a specific SSL chain count ssl.cert.alg="SHA256-RSA" β Search by certificate signature algorithm ssl.cert.issuer.cn="pbx.wildix.com" β Search by issuer common name ssl.cert.pubkey.rsa.bits=2048 β Search by RSA public key bit length ssl.cert.pubkey.type="RSA" β Search by public key type ssl.cipher.version="TLSv1.3" β Search by cipher suite version ssl.version="TLSv1.3" β Search by SSL version ssl.cert.subject.cn="example.com" β Search by subject common name ssl.jarm="β¦" β Search by JARM fingerprint ssl.ja3s=β¦ β Search by JA3S fingerprint IP or Domain Name Search ip="8.8.8.8" β Search for a specific IPv4 address cidr="52.2.254.36/24" β Search for assets within a C-class IP range org="Stanford University" β Search for assets belonging to an organization asn=42893 β Search by ASN port=80 β Search for assets running on a specific port domain="baidu.com" β Search for domain or subdomain assets http.header.server="Nginx" β Search by HTTP server header http.header.status_code="200" β Search by HTTP status code http.body="document" β Search by content in HTML body Fingerprint Search app="Cisco ASA SSL VPN" β Search for Cisco ASA-SSL-VPN devices service="ssh" β Search for a specific service (http, ftp, ssh, telnet, etc.) device="router" β Search by device type (router, switch, storage-misc, etc.) os="RouterOS" β Search by operating system industry="government" β Search by industry type product="Cisco" β Search by product/component information protocol="TCP" β Search by transport protocol is_honeypot="True" β Filter honeypot assets Time Filters after="2020-01-01" && port="50050" β Search for assets discovered after a specific date before="2020-01-01" && port="50050" β Search for assets discovered before a specific date Other Filters dig="baidu.com 220.181.38.148" β Search for assets containing specific dig results vul.cve="CVE-2021-44228" β Search for assets affected by a specific CVE iconhash="f3418a44β¦" β Search by icon MD5 hash filehash="0b5ce08β¦" β Search by file hash (e.g., Gitlab parsed file data) is_bugbounty=true β Filter assets that are part of a bug bounty program is_changed=true β Filter assets that changed within the last 7 days is_new=true β Filter assets newly discovered within the last 7 days








