1 files changed, 54 insertions, 0 deletions
diff --git a/2026/asn215540-report/censys-cli-queries.md b/2026/asn215540-report/censys-cli-queries.md
new file mode 100644
index 0000000..63fa51d
--- /dev/null
+++ b/2026/asn215540-report/censys-cli-queries.md
@@ -0,0 +1,54 @@
+# Censys CLI Queries Used
+
+## Prerequisites
+
+The Censys API tools (`search_hosts`, `aggregate`) were non-functional for this dataset. All host search queries were run via the Censys CLI with `--streaming` NDJSON output.
+
+## Queries
+
+### Find all hosts in ASN 215540
+```bash
+censys search --quiet --streaming --max-pages 10 --page-size 100 \
+  "host.autonomous_system.asn=215540"
+```
+
+### Find hosts by HASSH fingerprint within ASN
+```bash
+censys search --quiet --streaming --max-pages 5 --page-size 100 \
+  "host.autonomous_system.asn=215540 AND host.services.ssh.hassh_fingerprint=e42184b06d45385a906f0803d04c83da"
+```
+
+### Find hosts by exact SSH banner within ASN
+```bash
+censys search --quiet --streaming --max-pages 5 --page-size 100 \
+  'host.autonomous_system.asn=215540 AND host.services.ssh.endpoint_id.raw="SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16"'
+```
+
+### Find hosts in specific /24 block
+```bash
+censys search --quiet --streaming --max-pages 3 --page-size 100 \
+  'host.ip: "92.118.112.0/24"'
+```
+
+### Find hosts by PTR pattern
+```bash
+censys search --quiet --streaming --max-pages 5 --page-size 100 \
+  'host.dns.reverse_dns.names: "157279.ip-ptr.tech"'
+```
+
+## Field Extraction (jq)
+
+### Extract IP, location, PTR (TSV)
+```bash
+jq -r '.host | [.ip, .location.city // "?", .location.country_code // "?", .dns.reverse_dns.names[0] // "no-ptr"] | @tsv'
+```
+
+### Extract SSH build info
+```bash
+jq -r '.host.services[]? | select(.protocol=="SSH") | .ssh.endpoint_id.raw // empty'
+```
+
+### Summary counts by IP block
+```bash
+jq -r '.host.autonomous_system.bgp_prefix' | sort | uniq -c | sort -rn
+```