| Guide | GDE-061 |
| Topic | Censys OSINT |
| Domain | Internet-wide host and certificate search |
| Last updated | September 2026 |
Short answer: Search Censys by the organisation named in a TLS certificate or by a service and software version, open the full host record and note its scan date, then corroborate the finding against Shodan before attributing a host to a target.
What is Censys?
Censys is an internet-wide search engine that continuously scans public IP space and indexes hosts, open ports, services and TLS certificates, letting an investigator search for exposed infrastructure by attribute, such as a specific software banner, certificate field or organisation name, rather than knowing an IP address in advance.
Censys continuously scans the public internet and indexes what it finds: open ports, running services, software versions, TLS certificate details and the organisations those certificates name. A free account gives a limited number of monthly searches through the web interface; paid tiers unlock higher query volumes and full API access.
Its certificate search is one of its most distinctive features: since a TLS certificate often names the organisation it was issued to, searching by certificate attributes such as organisation name or issuer can surface infrastructure belonging to a target that would be difficult to find by IP address alone.
| • | Finding exposed infrastructure belonging to an organisation by searching TLS certificate attributes |
| • | Identifying hosts running a specific software version or service across the internet |
| • | Cross-referencing a Shodan finding against an independently maintained internet-scan index |
| • | Mapping a target organisation's public-facing infrastructure footprint |
How do you search with Censys?
Six steps from a first certificate search through to corroborating and documenting a finding.
The following resources are used across the steps below.
Censys Search: Free tier with limited monthly searches, paid tiers for API access and higher volume. The core search engine covered in this guide.
Shodan: Free tier available. A companion internet-scanning search engine for cross-verification (see this publication's separate Shodan guide).