Censys Opens Investigator API for Automated Threat-Intelligence Workflows
Summary
Censys says its Investigator API lets scripts, SOAR playbooks and AI agents expand submitted indicators into related infrastructure clusters and queries for blocklists, log hunts and monitoring, with CTI, triage and DFIR examples.
Key points
- Censys announced API access to Investigator, which accepts domains, IP addresses or threat-intelligence reports from scripts, SOAR playbooks and AI agents.
- Censys says investigations return reports linking related IPs, domains and services through shared fingerprints, along with a CenQL query and a downloadable archive.
- In a described phishing-campaign example, Censys says seven domains from a Microsoft report expanded into a 69-asset cluster; two indicators led to 58 additional ScreenConnect hosts and websites.
- The article describes turning investigation queries into monitored Collections and sending new results to OpenCTI or another threat-intelligence platform through webhooks.
- A SOAR triage example returns a 25-asset cluster from 10 destinations; Censys identifies the activity as a Lunex Stealer operation.
- A DFIR example expands eight C2 indicators into 46 assets for DNS and proxy searches. Censys also says results are retained for seven days, with a limit of three concurrent investigations per user and 150 per organization each week.
Article Details
- Event Type
- API availability for Censys Investigator, an agentic framework for automating threat-infrastructure investigations.
- Impact
- The API can expand submitted indicators into related infrastructure for blocklists, log searches, detection engineering, and incident scoping. In the article’s examples, seven phishing-campaign domains expanded to a 69-asset cluster, and C2 indicators revealed additional related infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | adacompliantsigns[.]online | Domain listed as part of an expanded cluster associated with a phishing campaign that abused MSP360 RMM to install ScreenConnect; recommended for blocklists and log searches. |
| DOMAIN | chapalasrealtor[.]com | Domain listed as part of an expanded cluster associated with a phishing campaign that abused MSP360 RMM to install ScreenConnect; recommended for blocklists and log searches. |
| DOMAIN | cobblestonecafe[.]us | Business-like domain in the incident-response example’s related infrastructure cluster; it shared the cluster’s subdomain pattern and pointed to the identified C2 IP. |
| DOMAIN | flowmeinhomes[.]com | Domain listed as part of an expanded cluster associated with a phishing campaign that abused MSP360 RMM to install ScreenConnect; recommended for blocklists and log searches. |
| DOMAIN | harborhouseplumbing[.]us | Business-like domain in the incident-response example’s related infrastructure cluster; it shared the cluster’s subdomain pattern and pointed to the identified C2 IP. |
| DOMAIN | mainethome[.]pro | Domain listed as part of an expanded cluster associated with a phishing campaign that abused MSP360 RMM to install ScreenConnect; recommended for blocklists and log searches. |
| DOMAIN | met[.]macroteams[.]site | Domain listed as part of an expanded cluster associated with a phishing campaign that abused MSP360 RMM to install ScreenConnect; recommended for blocklists and log searches. |
| DOMAIN | novalineyoga[.]us | Business-like domain in the incident-response example’s related infrastructure cluster; it shared the cluster’s subdomain pattern and pointed to the identified C2 IP. |
| DOMAIN | supoort-pdf[.]com | Domain listed as part of an expanded cluster associated with a phishing campaign that abused MSP360 RMM to install ScreenConnect; recommended for blocklists and log searches. |
| DOMAIN | verify-cloud[.]digital | Identified in the incident-response example as a C2 domain communicating with compromised servers. |
| IPV4 | 91[.]219[.]236[.]179 | Identified as a C2 IP in the incident-response example; related business-like domains resolved to it. |
Malware
Vendors
Products
Censys InvestigatorCensys Investigator, our agentic framework, now has an API.MSP360 RMMOn September 29, Microsoft published seven domains from a phishing campaign that abused MSP360 RMM to install ScreenConnect.ScreenConnectOn September 29, Microsoft published seven domains from a phishing campaign that abused MSP360 RMM to install ScreenConnect.