services
integer
Current numeric autonomous system number attributed to the service IP. Friendly label:
ASN. Operators: : = != < <= > >=.bool
Operators:
: = !=.string
Current ISO 3166-1 alpha-2 country code attributed to the service IP. Operators:
: = != =~ :~.integer
Distinct banner hashes ever seen on this service (change/churn signal). Operators:
: = != < <= > >=.integer
Distinct TLS leaf certs ever seen on this service (cert-rotation signal). Operators:
: = != < <= > >=.string
The domain the scan resulted in (may differ from ScanRequest) Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.timestamp
When this service was first observed (service age). Operators:
: = != < <= > >=.ip
IP address for the current service record. Operators:
: = !=.string
Current ISP or network organization name attributed to the service IP. Friendly label:
ISP Name. Operators: : = != =~ :~.timestamp
Most recent observation of this service. Operators:
: = != < <= > >=.integer
How many times this service has been scanned (got-bytes events). Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.uint32
The port the scan resulted in (may differ again from ScanRequest) Operators:
: = != < <= > >=.string
Normalized top-level protocol label for this current service record. Operators:
: = != =~ :~.repeated string
Canonical functional categories derived from the identified protocol. Operators:
: = != =~ :~.IdentificationQuality
Operators:
: = != =~ :~.double
Clean-success rate over got-bytes scans (success_count/observation_count). Operators:
: = != < <= > >=.timestamp
When this service was last scanned (most recent observation). Operators:
: = != < <= > >=.ScanStatus
The status of the scan Operators:
: = != =~ :~.integer
How many observations were a clean success. Operators:
: = != < <= > >=.string
Visible tag slug or name. Operators:
: = !=.Show Fields
Show Fields
string
Canonical slash-delimited category path assigned to a visible tag; a trailing /* matches descendants. Operators:
: =.timestamp
The timestamp in which the result was created Operators:
: = != < <= > >=.TransportProtocol
shouldnāt differ at all Operators:
: = != =~ :~.object
Show Fields
Show Fields
string
HASSH SSH fingerprint. Operators:
: = != =~ :~.string
JA3S server fingerprint. Friendly label:
JA3S. Operators: : = != =~ :~.string
JA4 client handshake fingerprint. Friendly label:
JA4. Operators: : = != =~ :~.string
JA4H HTTP fingerprint. Friendly label:
JA4H. Operators: : = != =~ :~.string
JA4N network fingerprint. Operators:
: = != =~ :~.string
JA4S server fingerprint. Friendly label:
JA4S. Operators: : = != =~ :~.string
JA4T transport/TCP fingerprint. Friendly label:
JA4T. Operators: : = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
repeated string
Application-layer protocols this HTTP service also speaks (mcp/elasticsearch/prometheus/kubernetes). Friendly label:
HTTP Capabilities. Operators: : = != =~ :~.Show Fields
Show Fields
string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
bool
Operators:
: = !=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.uint64
Operators:
: = != < <= > >=.object
object
object
Show Fields
Show Fields
string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.uint64
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
object
object
Show Fields
Show Fields
object
Show Fields
Show Fields
bool
Operators:
: = !=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
uint32
Operators:
: = != < <= > >=.bool
Operators:
: = !=.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.object
object
object
Show Fields
Show Fields
object
Show Fields
Show Fields
McpBinding
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.bool
Operators:
: = !=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.repeated string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.repeated string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.repeated string
Operators:
: = != =~ :~.bool
Operators:
: = !=.object
Show Fields
Show Fields
bool
Operators:
: = !=.string
Operators:
: = != =~ :~.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.object
object
object
Show Fields
Show Fields
uint64
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.uint64
Operators:
: = != < <= > >=.string
Two-letter ISO 3166-1 alpha-2 country code of the egress IP. Operators:
: = != =~ :~.string
Egress IP address used for the scan (from Cloudflare trace or proxy trace). Operators:
: = != =~ :~.string
Final URL the browser landed on after all HTTP and JS redirects. Operators:
: = != =~ :~.string
Promoted HTTP page title from the first parsed response <title> element. Friendly label:
HTTP Page Title. Operators: : = != =~ :~.object
Show Fields
Show Fields
bool
Operators:
: = !=.object
Show Fields
Show Fields
uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.timestamp
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.object
object
object
Show Fields
Show Fields
string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.object
Show Fields
Show Fields
uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.bool
Operators:
: = !=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.object
object
Show Fields
Show Fields
uint32
Friendly label:
DOM Size. Operators: : = != < <= > >=.string
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.object
object
Show Fields
Show Fields
string
Operators:
: = != =~ :~.bool
Operators:
: = !=.uint32
Operators:
: = != < <= > >=.object
Show Fields
Show Fields
timestamp
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.bool
Operators:
: = !=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.BrowserInitiatorType
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.HttpMethod
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.HttpVersion
Operators:
: = != =~ :~.BrowserResourceType
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.timestamp
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.BrowserInitiatorType
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.uint32
Operators:
: = != < <= > >=.uint32
Operators:
: = != < <= > >=.string
Operators:
: = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
uint32
Number of header count. Operators:
: = != < <= > >=.HttpVersion
Protocol. Operators:
: = != =~ :~.uint32
Status code. Included in overview projections. Operators:
: = != < <= > >=.string
Status line. Operators:
: = != =~ :~.object
Show Fields
Show Fields
timestamp
When the cert expires Included in overview projections. Operators:
: = != < <= > >=.timestamp
When the cert started being valid Included in overview projections. Operators:
: = != < <= > >=.TlsVersion
The TLS version Operators:
: = != =~ :~.object
Show Fields
Show Fields
string
HASSH SSH fingerprint. Operators:
: = != =~ :~.string
JA3S server fingerprint. Friendly label:
JA3S. Operators: : = != =~ :~.string
JA4 client handshake fingerprint. Friendly label:
JA4. Operators: : = != =~ :~.string
JA4H HTTP fingerprint. Friendly label:
JA4H. Operators: : = != =~ :~.string
JA4N network fingerprint. Operators:
: = != =~ :~.string
JA4S server fingerprint. Friendly label:
JA4S. Operators: : = != =~ :~.string
JA4T transport/TCP fingerprint. Friendly label:
JA4T. Operators: : = != =~ :~.string
Operators:
: = != =~ :~.object
Show Fields
Show Fields
repeated string
List of DNS names. Operators:
: = != =~ :~.string
Fingerprint. Operators:
: = != =~ :~.bool
Whether is ca. Operators:
: = !=.uint32
Operators:
: = != < <= > >=.bool
True when subject and issuer are the same identity. Operators:
: = !=.string
Serial number. Operators:
: = != =~ :~.string
Signature algorithm. Operators:
: = != =~ :~.object
object
Show Fields
Show Fields
string
MD5 digest (hex). Operators:
: = != =~ :~.string
Signed 32-bit Murmur3 hash encoded as a base-10 string. Operators:
: = != =~ :~.string
SHA-1 digest (hex). Operators:
: = != =~ :~.string
SHA-256 digest (hex). Operators:
: = != =~ :~.string
ssdeep fuzzy hash. Operators:
: = != =~ :~.string
TLSH fuzzy hash. Operators:
: = != =~ :~.object
Show Fields
Show Fields
string
Common name. Operators:
: = != =~ :~.string
Country. Operators:
: = != =~ :~.string
Email address. Operators:
: = != =~ :~.string
Locality. Operators:
: = != =~ :~.string
Organization. Operators:
: = != =~ :~.string
Organizational unit. Operators:
: = != =~ :~.string
Province. Operators:
: = != =~ :~.object
Show Fields
Show Fields
string
First 12 hex chars of SHA-256 over extension OIDs in wire order. Operators:
: = != =~ :~.string
First 12 hex chars of SHA-256 over issuer RDN OIDs in wire order. Operators:
: = != =~ :~.string
First 12 hex chars of SHA-256 over subject RDN OIDs in wire order. Operators:
: = != =~ :~.string
Full JA4X value: ā<issuer><subject><extensions>ā. Operators:
: = != =~ :~.object
Show Fields
Show Fields
string
Common name. Operators:
: = != =~ :~.string
Country. Operators:
: = != =~ :~.string
Email address. Operators:
: = != =~ :~.string
Locality. Operators:
: = != =~ :~.string
Organization. Operators:
: = != =~ :~.string
Organizational unit. Operators:
: = != =~ :~.string
Province. Operators:
: = != =~ :~.object