# Censys CLI Queries Used

## Prerequisites

The Censys API tools (`search_hosts`, `aggregate`) were non-functional for this dataset. All host search queries were run via the Censys CLI with `--streaming` NDJSON output.

## Queries

### Find all hosts in ASN 215540
```bash
censys search --quiet --streaming --max-pages 10 --page-size 100 \
  "host.autonomous_system.asn=215540"
```

### Find hosts by HASSH fingerprint within ASN
```bash
censys search --quiet --streaming --max-pages 5 --page-size 100 \
  "host.autonomous_system.asn=215540 AND host.services.ssh.hassh_fingerprint=e42184b06d45385a906f0803d04c83da"
```

### Find hosts by exact SSH banner within ASN
```bash
censys search --quiet --streaming --max-pages 5 --page-size 100 \
  'host.autonomous_system.asn=215540 AND host.services.ssh.endpoint_id.raw="SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16"'
```

### Find hosts in specific /24 block
```bash
censys search --quiet --streaming --max-pages 3 --page-size 100 \
  'host.ip: "92.118.112.0/24"'
```

### Find hosts by PTR pattern
```bash
censys search --quiet --streaming --max-pages 5 --page-size 100 \
  'host.dns.reverse_dns.names: "157279.ip-ptr.tech"'
```

## Field Extraction (jq)

### Extract IP, location, PTR (TSV)
```bash
jq -r '.host | [.ip, .location.city // "?", .location.country_code // "?", .dns.reverse_dns.names[0] // "no-ptr"] | @tsv'
```

### Extract SSH build info
```bash
jq -r '.host.services[]? | select(.protocol=="SSH") | .ssh.endpoint_id.raw // empty'
```

### Summary counts by IP block
```bash
jq -r '.host.autonomous_system.bgp_prefix' | sort | uniq -c | sort -rn
```