Internet Scanning Results

Combine conditions with AND, OR, and NOT. Precedence is NOT, then AND, then OR; parentheses make grouping explicit. Quote values containing spaces or parentheses with double quotes; escape quotes and backslashes with a backslash.

= means exact match; ~ means a literal substring, not a regular expression or wildcard. Text matching is case-insensitive by default; =! and ~! make it case-sensitive. : is an alias for exact match, except banner: means substring. Regex is deferred and is not supported.

Fields: ip (address or CIDR), transport (tcp/udp), port, protocol (ssh/http/tls; alias service), status, source, banner, product, version, http.title, http.header.<name>, http.status, tls.name, tls.issuer, tls.fingerprint, tls.not_before, tls.expiry, and tls.expired.

Ports, HTTP status, version ranges, and certificate times support <, <=, >, and >=. Use RFC3339 times such as 2026-01-01T00:00:00Z. tls.expired=true compares expiry with when the scan was grabbed; tls.expired=false selects certificates not expired then. An explicit timestamp, such as tls.expired=2026-01-01T00:00:00Z, checks expiry at that instant. Search period independently limits when scans were grabbed.

Version ordering needs explicit product context: version.nginx>=1.2.3, not an unqualified version>=1.2.3. nginx and apache compare exactly three numeric components; openssh compares major.minor with optional pN patch level (absent means zero). Each component is 0–999999; leading zeros do not affect ordering. For example: version.openssh>=9.6p1. Recorded labels, including suffixes and revisions, remain available for exact matching. Other suffixes are not orderable. No cross-product or distribution-package version ordering is inferred.

Product/version evidence is limited to each recorded HTTP Server header's leading product token and SSH server-software identifiers. HTTP comments and SSH comments are not version labels; arbitrary banner text is not normalized product evidence. Header names are case-insensitive and repeated values are matched independently, never concatenated. TLS predicates use leaf-certificate evidence only.

Quote an entire field name when a header contains query punctuation: "http.header.x~!y"="value". The structured editor preserves these names when switching back to the query bar.

Missing or unrecognized evidence is unknown, not false. NOT does not turn missing HTTP/TLS/product metadata into a match. Older scans without transport or richer protocol details remain unknown for those predicates. A header match examines stored values for that header; certificate names match the recorded DNS names.

(protocol=http OR protocol=tls) AND port=443 AND NOT http.title~"staging"

product=nginx AND version.nginx>=1.2.3 AND http.header.server~nginx

Limits: 8,192 bytes of query text, 128 expression nodes, 16 levels of nesting, and 2,048 bytes per value. Invalid predicates are rejected; they never fall back to an unfiltered search.