menu_book
Search Syntax
Zondex uses a Shodan-style dork syntax. Combine filters and free text to find exactly what you need across 34M+ indexed services.
bolt Quick Start
Free text
Type any word to search across service, product, http_title, manufacturer, hostname, and http_server columns.
nginxCombining
All filters are combined with AND. Separate multiple filters with spaces.
product:nginx port:443 country:DEcalculate Numeric Operators
Some fields (honeypot, cvss, banner.hash) support numeric comparison:
| Operator | Meaning | Example |
|---|---|---|
| > | Greater than | honeypot:>5 |
| >= | Greater or equal | cvss:>=9.0 |
| < | Less than | honeypot:<3 |
| <= | Less or equal | cvss:<=5.0 |
| = | Exact match (default) | honeypot:0 |
filter_alt Core Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| port | port | TCP/UDP port number | Exact | port:22 |
| service | service | Service name (ssh, http, ftp...) | LIKE | service:ssh |
| country | country_code | 2-letter ISO country code | Exact | country:US |
| city | city | City name | LIKE | city:Berlin |
| product | product | Software product name | LIKE | product:nginx |
| version | version | Software version | LIKE | version:1.18 |
| org | asn_org | ASN organization name | LIKE | org:"Google LLC" |
| asn | asn | AS number | Exact | asn:15169 |
| ip | ip | Exact IPv4 address | Exact | ip:8.8.8.8 |
| protocol | protocol | Transport protocol (tcp/udp) | Exact | protocol:udp |
| os | os_family | OS family (Linux, Windows...) | LIKE | os:Linux |
| device | device_type | Device type (router, camera...) | LIKE | device:camera |
| tls | tls_enabled | TLS enabled (true/false) | Boolean | tls:true |
| banner | banner | Service banner text | LIKE | banner:"Server: Apache" |
| hostname | hostname | Hostname | LIKE | hostname:mail |
| domain | domain | Domain name | LIKE | domain:google.com |
language HTTP Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| http.title | http_title | HTTP page title | LIKE | http.title:Login |
| http.status | http_status_code | HTTP status code | Exact | http.status:200 |
| http.headers | http_headers | Raw HTTP headers | LIKE | http.headers:X-Powered-By |
| cms | cms | CMS / technology | LIKE | cms:WordPress |
| cms.version | cms_version | CMS version | LIKE | cms.version:6 |
lock TLS / SSL Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| ssl.issuer | tls_cert_issuer | Certificate issuer | LIKE | ssl.issuer:"Let's Encrypt" |
| ssl.san | tls_cert_sans | Subject Alternative Names (array) | has() | ssl.san:example.com |
| cert.sha256 | cert_sha256 | Certificate SHA-256 hash | Exact | cert.sha256:a1b2c3... |
| jarm | jarm_hash | JARM TLS fingerprint | Exact | jarm:29d29d... |
terminal SSH Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| ssh.fingerprint | ssh_fingerprint | SSH host key fingerprint | LIKE | ssh.fingerprint:SHA256:... |
| ssh.hassh | hassh_server | HASSH server fingerprint | LIKE | ssh.hassh:abc123... |
| ssh.keytype | ssh_host_key_type | SSH key type | Exact | ssh.keytype:ssh-rsa |
fingerprint Hash Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| favicon.hash | favicon_hash | Favicon image hash | Exact | favicon.hash:-12345 |
| html.hash | html_body_hash | HTML body hash | Exact | html.hash:123456 |
| banner.hash | banner_hash | Banner hash (numeric) | Numeric | banner.hash:987654 |
dns Network / DNS Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| rdns | reverse_dns | Reverse DNS hostname | LIKE | rdns:google |
| rdap.net | rdap_net_name | RDAP network name | LIKE | rdap.net:GOOGLE |
| rdap.country | rdap_country | RDAP-registered country | Exact | rdap.country:US |
| cidr | ip | IP CIDR range | CIDR | cidr:1.2.3.0/24 |
shield Scoring & Detection
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| cve | cve_ids | CVE identifier (array) | has() | cve:CVE-2021-44228 |
| cvss | max_cvss | Max CVSS score (0-10) | Numeric | cvss:>=9.0 |
| honeypot | honeypot_score | Honeypot score (0-10) | Numeric | honeypot:>7 |
| waf | waf | Web Application Firewall | Exact | waf:Cloudflare |
data_array Array Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| tag | tags | Service tags | has() | tag:honeypot |
| cpe | cpe | CPE identifier | has() | cpe:cpe:2.3:a:apache:* |
devices Device Details
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| vendor | vendor | Device vendor/manufacturer | LIKE | vendor:Cisco |
| model | model | Device model | LIKE | model:RV340 |
| firmware | firmware | Firmware version | LIKE | firmware:1.0.3 |
date_range Date Range Filters
| Filter | Column | Description | Match | Example |
|---|---|---|---|---|
| after | scan_date | Scanned on or after date | >= date | after:2025-01-01 |
| before | scan_date | Scanned on or before date | <= date | before:2025-06-30 |
swap_horiz Compatibility Aliases
These aliases provide compatibility with other search engines:
| Alias | Maps to | Compatibility | Example |
|---|---|---|---|
| app | product | ZoomEye | app:nginx |
| title | http_title | Shodan | title:Login |
| ssl | tls_cert_issuer | Shodan | ssl:"Let's Encrypt" |