#### Prismview (Cartelloni Elettronici Samsung) [🔎 →](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%22Prismview%22+or+services.http.response.headers.server%3A+%22Prismview+Player%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: "Prismview" or services.http.response.headers.server: "Prismview Player"

> **Suggerimento**: Aggiungi `services.truncated: false` alla tua query per escludere honeypot (Host con 100+ servizi).

<details>
    <summary markdown="span">Schermata</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/3af28d3f35ed648c44d6dd7ce1be7c8e9db2cac51afe7ba4e0af5245dc161838.png" alt="atg" width="500px" />
</details>

#### Caricabatterie per veicoli elettrici [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28http.response.headers.server%3A+%22gSOAP%2F2.8%22+and+http.response.headers.content_length%3A+583%29&ref=awesome-censys-queries)```dsl
same_service(http.response.headers.server: "gSOAP/2.8" and http.response.headers.content_length: 583)

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://www.carel.com/product/plantvisor>

</details>

#### C4 Max GPS per veicoli [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner%3A+%22%5B1m%5B35mWelcome+on+console%22&ref=awesome-censys-queries)```dsl
services.banner: "[1m[35mWelcome on console"

<details>
    <summary markdown="span">Schermata</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/7646398750494dd77193893cc08e6338f39ba78b650b834a80d142fa2efabecb.png" alt="gaugetech" width="500px" />
</details>

#### XZERES Turbine eoliche [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=services.http.response.html_title%3A+%22XZERES+Wind%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "XZERES Wind"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-307-01>

</details>

#### Saferoads VMS Signs [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.software%3A+%28vendor%3A+%22Saferoads%22+and+product%3A+%22VMS%22%29&ref=awesome-censys-queries)```dsl
services.software: (vendor: "Saferoads" and product: "VMS")

#### Mein Automowers [🔎 →](https://search.censys.io/search?resource=hosts&q=services.http.response.headers.Www_Authenticate%3A+%60Basic+realm%3D+%22Mein+Automower+%28Robonect+Hx%2B%29%22%60&ref=awesome-censys-queries)```dsl
services.http.response.headers.Www_Authenticate: `Basic realm= "Mein Automower (Robonect Hx+)"`

#### Emerson Site Supervisor [🔎 →](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Emerson+Site+Supervisor%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Emerson Site Supervisor"

#### Elnet Power Meters [🔎 →](https://search.censys.io/search?resource=hosts&q=same_service%28services.http.response.headers.Server%3D%22CAL1.0%22+and+services.http.response.status_code%3A+200%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.headers.Server="CAL1.0" and services.http.response.status_code: 200)

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://nethix.com/en/>

</details>

#### Router Mikrotik Compromesso [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.service_name%3A+MIKROTIK_BW+and+services.pptp.hostname%3A+%22HACKED%22&ref=awesome-censys-queries)```dsl
services.service_name: MIKROTIK_BW and services.pptp.hostname: "HACKED"

#### Server Metasploit [🔎 →](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Metasploit%22+and+%28%0A++++services.tls.certificates.leaf_data.subject.organization%3A+%22Rapid7%22%0A++++or+services.tls.certificates.leaf_data.subject.common_name%3A+%22MetasploitSelfSignedCA%22%0A%29%0Aor+services.jarm.fingerprint%3A+%7B%0A++++%2207d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d%22%2C%0A++++%2207d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823%22%0A%7D&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Metasploit" and (
    services.tls.certificates.leaf_data.subject.organization: "Rapid7"
    or services.tls.certificates.leaf_data.subject.common_name: "MetasploitSelfSignedCA"
)
or services.jarm.fingerprint: {
    "07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d",
    "07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823"
}

#### NTOP Analizzatori di Rete [🔎 →](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Welcome+to+ntopng%22%0Aor+same_service%28%0A++++services.http.response.html_title%3A+%22Global+Traffic+Statistics%22%0A++++and+services.http.response.headers.server%3A+%22ntop%2F%2A%22%0A%29&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Welcome to ntopng"
or same_service(
    services.http.response.html_title: "Global Traffic Statistics"
    and services.http.response.headers.server: "ntop/*"
)

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/Ne0nd0g/merlin>

</details>

#### Mythic C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28port%3A+7443+and+tls.certificates.leaf_data.subject.organization%3A+%22Mythic%22%29&ref=awesome-censys-queries)```dsl
same_service(port: 7443 and tls.certificates.leaf_data.subject.organization: "Mythic")

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/DeimosC2/DeimosC2>

</details>

#### Covenant C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28%0A++++http.response.body%3A+%7B%22Blazor%22%2C+%22covenant.css%22%7D%0A++++and+tls.certificates.leaf_data.issuer.common_name%3A+%22Covenant%22%0A%29&ref=awesome-censys-queries)```dsl
same_service(
    http.response.body: {"Blazor", "covenant.css"}
    and tls.certificates.leaf_data.issuer.common_name: "Covenant"
)

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/nettitude/PoshC2>

</details>

#### Sliver C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28%0A++++services.tls.certificates.leaf_data.pubkey_bit_size%3A+2048+and%0A++++services.tls.certificates.leaf_data.subject.organization%3A+%2F%28ACME%7CPartners%7CTech%7CCloud%7CSynergy%7CTest%7CDebug%29%3F+%3F%28co%7Cllc%7Cinc%7Ccorp%7Cltd%29%3F%2F+and%0A++++services.jarm.fingerprint%3A+3fd21b20d00000021c43d21b21b43d41226dd5dfc615dd4a96265559485910+and%0A++++services.tls.certificates.leaf_data.subject.country%3A+US+and%0A++++services.tls.certificates.leaf_data.subject.postal_code%3A+%2F%3C1001-9999%3E%2F%0A%29&ref=awesome-censys-queries)```dsl
same_service(
    services.tls.certificates.leaf_data.pubkey_bit_size: 2048 and
    services.tls.certificates.leaf_data.subject.organization: /(ACME|Partners|Tech|Cloud|Synergy|Test|Debug)? ?(co|llc|inc|corp|ltd)?/ and
    services.jarm.fingerprint: 3fd21b20d00000021c43d21b21b43d41226dd5dfc615dd4a96265559485910 and
    services.tls.certificates.leaf_data.subject.country: US and
    services.tls.certificates.leaf_data.subject.postal_code: /<1001-9999>/
)

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/kgretzky/evilginx2>

</details>

#### Brute Ratel C4 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.body_hash%3D%22sha1%3A1a279f5df4103743b823ec2a6a08436fdf63fe30%22&ref=awesome-censys-queries)```dsl
services.http.response.body_hash="sha1:1a279f5df4103743b823ec2a6a08436fdf63fe30"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://bc-security.gitbook.io/empire-wiki/>

</details>

#### Raccoon Stealer V2 (RecordBreaker C2) [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner_hashes%3A+%22sha256%3A7987d0c39c4839572ab88c6d82da01395f74e0c31f12d94c58d0e1bed0b0c75c%22&ref=awesome-censys-queries)```dsl
services.banner_hashes: "sha256:7987d0c39c4839572ab88c6d82da01395f74e0c31f12d94c58d0e1bed0b0c75c"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/chvancooten/NimPlant>
- <https://twitter.com/chvancooten/status/1629911090774589442>

</details>

#### RedGuard [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject_dn%3A+%22C%3DCN%2C+L%3DHangZhou%2C+O%3DAlibaba+%28China%29+Technology+Co.%5C%5C%2C+Ltd.%2C+CN%3D%5C%2A.aliyun.com%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject_dn: "C=CN, L=HangZhou, O=Alibaba (China) Technology Co.\\, Ltd., CN=\*.aliyun.com"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### BitRAT [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%22BitRAT%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: "BitRAT"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### QuasarRAT [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%7B%22Anony96%22%2C+%22Quasar+Server+CA%22%7D&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: {"Anony96", "Quasar Server CA"}

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### DcRat [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%22DcRat+Server%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: "DcRat Server"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f>
- <https://github.com/DeimosC2/DeimosC2/blob/2f368a5b151ea2da9f4fcc3627b1eb7d28b38fe5/c2/lib/certs/gen_cert.go>

</details>

#### Posh C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject_dn%3A+%22C%3DUS%2C+ST%3DMinnesota%2C+L%3DMinnetonka%2C+O%3DPajfds%2C+OU%3DJethpro%2C+CN%3DP18055077%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject_dn: "C=US, ST=Minnesota, L=Minnetonka, O=Pajfds, OU=Jethpro, CN=P18055077"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://malware.news/t/melting-ice-tracking-icedid-servers-with-a-few-simple-steps/49525>
- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### Gozi Malware [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.issuer_dn%3A+%22C%3DXX%2C+ST%3D1%2C+L%3D1%2C+O%3D1%2C+OU%3D1%2C+CN%3D%5C%2A%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.issuer_dn: "C=XX, ST=1, L=1, O=1, OU=1, CN=\*"

> **Nota**: Questa ricerca utilizza regex e richiede un account a pagamento.

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/n1nj4sec/pupy>

</details>

#### Responder Server [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner%3D%22HTTP%2F1.1+401+Unauthorized%5Cr%5CnServer%3A+Microsoft-IIS%2F7.5%5Cr%5CnDate%3A++%3CREDACTED%3E%5Cr%5CnContent-Type%3A+text%2Fhtml%5Cr%5CnWWW-Authenticate%3A+NTLM%5Cr%5CnContent-Length%3A+0%5Cr%5Cn%22&ref=awesome-censys-queries)```dsl
services.banner="HTTP/1.1 401 Unauthorized\r\nServer: Microsoft-IIS/7.5\r\nDate:  <REDACTED>\r\nContent-Type: text/html\r\nWWW-Authenticate: NTLM\r\nContent-Length: 0\r\n"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://twitter.com/BushidoToken/status/1633458241421320192>

</details>

#### Host con elenco di directory aperto con nomi di file sospetti nei loro contenuti [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28%0A++++%28services.http.response.html_title%3A%22Index+of+%2F%22+or+services.http.response.html_title%3A%22Directory+Listing+for+%2F%22%29%0A++++and+services.http.response.body%3A+%2F.%2A%3F%28cve%7Cmetasploit%7Ccobaltstrike%7Csliver%7Ccovenant%7Cbrc4%7Cbrute-ratel%7Ccommander-runme%7Cbruteratel%7Cps2exe%7C%28badger%7Cshellcode%7Csc%7Cbeacon%7Cartifact%7Cpayload%7Cteamviewer%7Canydesk%7Cmimikatz%7Ccs%7Crclone%29%5C.%28exe%7Cps1%7Cvbs%7Cbin%7Cnupkg%29%29.%2A%2F%0A%29&ref=awesome-censys-queries)```dsl
same_service(
    (services.http.response.html_title:"Index of /" or services.http.response.html_title:"Directory Listing for /")
    and services.http.response.body: /.*?(cve|metasploit|cobaltstrike|sliver|covenant|brc4|brute-ratel|commander-runme|bruteratel|ps2exe|(badger|shellcode|sc|beacon|artifact|payload|teamviewer|anydesk|mimikatz|cs|rclone)\.(exe|ps1|vbs|bin|nupkg)).*/
)

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://www.splunk.com>

</details>

### Database

#### Server CouchDB esposti [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.body%3A+%27%22couchdb%22%3A+%22Welcome%22%27&ref=awesome-censys-queries)```dsl
services.http.response.body: '"couchdb": "Welcome"'

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/google/cadvisor>

</details>

#### Dashboard di HashiCorp Consul [🔎 ⇢](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=same_service%28services.http.response.html_title%3D%60Consul+by+HashiCorp%60+and+services.http.request.uri%3A+%22%2A%2Fui%2F%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.html_title=`Consul by HashiCorp` and services.http.request.uri: "*/ui/")

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://www.netdata.cloud/>

</details>

#### Dashboard di Rancher [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=same_service%28services.http.response.headers.unknown.name%3A+%22X-Rancher-Version%22+and+services.http.response.html_title%3A+%22Loading%26hellip%3B%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.headers.unknown.name: "X-Rancher-Version" and services.http.response.html_title: "Loading&hellip;")

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/traefik/traefik>

</details>

#### Weave Scope [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28services.http.response.html_title%3A+%22Weave+Scope%22+and+services.http.response.body%3D%22%2AWEAVEWORKS_CSRF%2A%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.html_title: "Weave Scope" and services.http.response.body="*WEAVEWORKS_CSRF*")

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://coolify.io/>

</details>

### Server di gioco

#### Server di gioco Counter-Strike [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28banner%3A+%22Counter-Strike%22+and+service_name%3A+VALVE%29&ref=awesome-censys-queries)```dsl
same_service(banner: "Counter-Strike" and service_name: VALVE)

#### Server Minecraft [🔎 →](https://search.censys.io/search?resource=hosts&q=services.service_name%3A+%22MINECRAFT%22&ref=awesome-censys-queries)```dsl
services.service_name: "MINECRAFT"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://plex.tv/>

</details>

#### Jellyfin Media Server [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.software.vendor%3A+%22Jellyfin%22&ref=awesome-censys-queries)```dsl
services.software.vendor: "Jellyfin"

<details>
    <summary markdown="span">Screenshot</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/2c62848ce0155935c4376cbc52d52b6a8c88cb89bfa41b2536bb61ff4fc28d62.png" alt="mythweb" width="500px" />
</details>

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/MythTV/mythweb>

</details>

### Servizi casuali

#### Host che emettono payload GNSS [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner%3A+%22%24GPRMC%22&ref=awesome-censys-queries)```dsl
services.banner: "$GPRMC"

#### Swagger UI [🔎 →](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Swagger+UI+-+%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Swagger UI - "

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://github.com/mongo-express/mongo-express>

</details>

#### shell2http [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=services.http.response.html_title%3A+%22shell2http%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "shell2http"

<details>
    <summary markdown="span">Screenshot</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/62eda0f6198b7d4489c3841d75de5d287314e70f10f623433bfaa887095b67fa.png" alt="busybox" width="500px" />
</details>

#### Server Redis non autenticati [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.redis.ping_response%3A+%22PONG%22&ref=awesome-censys-queries)```dsl
services.redis.ping_response: "PONG"

#### WordPress malconfigurato [🔎 →](https://search.censys.io/search?resource=hosts&q=services.http.response.body%3A+%22The+wp-config.php+creation+script+uses+this+file%22&ref=awesome-censys-queries)```dsl
services.http.response.body: "The wp-config.php creation script uses this file"

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://adguard.com/en/welcome.html>

</details>

#### Prometheus Node Exporters [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28services.http.response.html_title%3A+%22node+exporter%22+and+services.http.response.body%3A+%22%2Fmetrics%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.html_title: "node exporter" and services.http.response.body: "/metrics")

<details>
    <summary markdown="span">Schermata</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/bcd1d7facddeb395e6703caf5044ee11f4ab2c6c8c40a4e6b902db273d2580a8.png" alt="vmagent" width="500px" />
</details>

<details>
    <summary markdown="span">Riferimenti</summary>

- <https://docs.victoriametrics.com/vmagent.html>

</details>

#### SonarQube [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28http.response.html_title%3A+%22SonarQube%22+and+http.response.status_code%3A+200+and+http.response.protocol%3A+%22HTTP%2F1.1%22%29&ref=awesome-censys-queries)```dsl
same_service(http.response.html_title: "SonarQube" and http.response.status_code: 200 and http.response.protocol: "HTTP/1.1")

#### Host Honeypot [🔎 →](https://search.censys.io/search?resource=hosts&q=services.truncated%3A+true&ref=awesome-censys-queries)```dsl
services.truncated: true

#### Host che si identificano come governo o esercito degli Stati Uniti [🔎 →](https://search.censys.io/search?resource=hosts&q=dns.names%3A+%2A.gov+or+dns.names%3A+%2A.mil+or+name%3A+%2A.gov+or+name%3A+%2A.mil&ref=awesome-censys-queries)```dsl
dns.names: *.gov or dns.names: *.mil or name: *.gov or name: *.mil

> Sintassi alternativa senza il prefisso `services.` all'interno della funzione `same_service`:
> ```dsl
same_service(port: 53 and not service_name: DNS) and services.truncated: false```

#### Non-Standard Services Listening on Common Ports [🔎 →](https://search.censys.io/search?resource=hosts&q=same_service%28services.port%3A+%7B21%2C+22%2C+80%7D+and+not+services.service_name%3A+%7BHTTP%2C+SSH%2C+FTP%2C+UNKNOWN%7D%29+and+services.truncated%3A+false&ref=awesome-censys-queries)

```dsl
same_service(services.port: {21, 22, 80} and not services.service_name: {HTTP, SSH, FTP, UNKNOWN}) and services.truncated: false```

#### Services Listening on Port 22 that are not SSH [🔎 →](https://search.censys.io/search?resource=hosts&q=same_service%28services.port%3A+22+and+not+services.service_name%3A+%7BSSH%7D+and+not+services.banner%3A+%7B%22Connection+refused%22%2C+%22SSH-%22%2C+%22Exceeded+MaxStartups%22%2C+%22Too+many+users%22%2C+%22Connection+closed+by+server%22%7D%29+and+services.truncated%3A+false&ref=awesome-censys-queries)

```dsl
same_service(services.port: 22 and not services.service_name: {SSH} and not services.banner: {"Connection refused", "SSH-", "Exceeded MaxStartups", "Too many users", "Connection closed by server"}) and services.truncated: false```

#### Services Listening on 80 or 443 that are not HTTP or HTTPS (or UNKNOWN with TLS) [🔎 →](https://search.censys.io/search?resource=hosts&q=not+same_service%28services.port%3A+443+and+services.name%3A+UNKNOWN+and+services.tls.certificates.leaf_data.subject_dn%3A+%2A%29+and+same_service%28services.port%3A+%7B80%2C+443%7D+and+not+services.service_name%3A+%7BKUBERNETES%2C+ANYCONNECT%2C+OPENVPN%2C+HTTP%7D+and+not+services.banner%3A+%22HTTP%2F%22%29+and+services.truncated%3A+false&ref=awesome-censys-queries)

```dsl
not same_service(services.port: 443 and services.name: UNKNOWN and services.tls.certificates.leaf_data.subject_dn: *) and same_service(services.port: {80, 443} and not services.service_name: {KUBERNETES, ANYCONNECT, OPENVPN, HTTP} and not services.banner: "HTTP/") and services.truncated: false```

## Credits

- [jakejarvis/awesome-shodan-queries](https://github.com/jakejarvis/awesome-shodan-queries)
- [woj-ciech/Kamerka-GUI](https://github.com/woj-ciech/Kamerka-GUI)
- [salesforce/jarm](https://github.com/salesforce/jarm)
- [cedowens/C2-JARM](https://github.com/cedowens/C2-JARM)
- [emilyaustin/censys-resources](https://github.com/emilyaustin/censys-resources)
- [drb-ra](https://github.com/drb-ra)
- [The State of SSL/TLS Certificate Usage in Malware C&C Communications](https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf)
- [Hunting C2 - Michael Koczwara](https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f)

## License

[![CC0](http://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0/)

## Star History

[![Star History Chart](https://assets.kitploit.com/production/public/readmes/placeholders/f0fc86cfe65f76d40e15aaec61704ec8220a56dc89d4be03c46f67cb31b9fa8c.svg)](https://star-history.com/#thehappydinoa/awesome-censys-queries&Date)