How To Use Censys

Threat Intelligence Guides

Identifying Qakbot Servers with Regex and TLS Certificates

Catching 83 Qakbot Servers using Regular Expressions.

Threat Intelligence Guides

How To Build Advanced Threat Intelligence Queries Utilising Regex and TLS Certificates - (BianLian)

Creating Regex Signatures on TLS Certificates with Censys.

Threat Intelligence Guides

Identifying PrivateLoader Servers with Infrastructure Queries

Refining Queries and Identifying Suspicious servers using Censys.

Threat Intelligence Guides

Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

More interesting and practical queries for identifying malware infrastructure.

Threat Intelligence Guides

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Identifying Malware infrastructure by combining weak pivot points.

Threat Intelligence Guides

Identifying Simple Pivot Points in Malware Infrastructure - RisePro Stealer

Identifying Simple pivot points in RisePro Stealer Infrastructure using Censys.

Threat Intelligence Guides

Practical Queries for Identifying Malware Infrastructure - Part 2

Threat Intelligence Queries with Censys.

Threat Intelligence Guides

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

An informal page for storing Censys/Shodan queries

Threat Intelligence Guides

How To Track Malware Infrastructure - Identifying Laplas Infrastructure Using Hardcoded TLS Certificates

Identification of Laplas infrastructure with Shodan and Censys.