Hosts Examples

Example Queries:

Hosts with an IP address within two ranges expressed as CIDR blocks

Hosts with an IP address in the IPv4 range

Hosts with an IP address in the IPv6 range

Hosts with an Elasticsearch service open on port 443

Hosts with any of the following port numbers open: 21, 22, 23, 24, 25

Hosts with an IP address within a non-standard range

Hosts with a service that enables remote access or file sharing in Europe

Hosts with a service redirecting to an Outlook Web App login page

Hosts with a page title on an HTTP service containing the word "dashboard"

Hosts with any service presenting a certificate that expires on or after June 30, 2023

Hosts with the phrase "Index of" anywhere that also have an SSH service exposed

Hosts with a service presenting a TLS certificate containing the name "localhost"

Hosts with a service with a combination of operating system and application software

Hosts with an SNMP service whose location value is exactly the phrase "Sitting on the Dock of the Bay"

Hosts with no HTTP services

Hosts with at least one non-HTTP service

Hosts with a non-truncated amount of services (i.e., more than 100 services is indicative of a honeypot)

Hosts with any field containing the word "hello" directly followed by at least one character

Hosts with any service presenting a certificate containing the name pattern foo1, foo2, foo3...foo100 followed by any value (regular expresion)

Hosts with an SSH service running on ports other than port 22 and 2222

Hosts with an HTTP service that responded with a server error status code

Hosts with an HTTP service that has specific header-value pairs

Hosts with an RDP service presenting a certificate

Hosts with any service using an insecure TLS version

Hosts running a Raspberry Pi product

Hosts in ASes whose description contains the word "university"