What is Profundis Hosts Search?

Profundis Hosts Search is a specialized cybersecurity search engine that indexes billions of services and exposed hosts worldwide. It allows security professionals, OSINT researchers, and bug bounty hunters to discover exposed infrastructure, open ports, SSL certificates, security headers, and technologies running on hosts. Data is collected from public sources including internet archives, search engines, and IANA, then enriched with web titles, headers, and response codes.

How do I search for hosts on Profundis?

You can search using the host: filter with wildcards. For example, 'host:*.example.com' finds all subdomains of example.com, while 'host:example.com' only matches that exact domain. You can combine filters using AND/OR operators and parentheses for complex queries like 'host:*.example.com AND port:443 AND technologies:nginx'. Click on elements in result cards to quickly add filters to your search.

What filters can I use in Hosts Search?

Profundis Hosts Search supports multiple filters: host: (domain names with wildcard support), port: (open ports like 443, 80, 22), ip: (IP addresses), asn: (Autonomous System Numbers), country: (geographic location), technologies: (detected technologies like Apache, nginx, PHP), header_server_name: (server headers), and ssl_cert: (SSL certificate data). You can combine these filters with AND/OR boolean operators for precise queries.

How often is Profundis data updated?

Profundis continuously ingests data 24/7 with an average rate of 15-25 million hosts per day (515 hosts per second). Assets are permanently discovered and refreshed, though the statistics represent both new discoveries and refreshed existing data. You can see the exact scan date on each result card. Data is processed in batches approximately every 3-4 minutes and may not be immediately searchable after ingestion.

Can I search for specific ports or technologies?

Yes! Use the port: filter to find hosts with specific open ports (e.g., 'port:3389' for RDP, 'port:22' for SSH). Use the technologies: filter to find hosts running specific software (e.g., 'technologies:WordPress', 'technologies:Apache'). You can combine multiple filters: 'port:443 AND technologies:nginx AND country:US' to find HTTPS servers running nginx in the United States.

What is the difference between strict and wildcard searches?

Strict searches match exactly: 'host:example.com' only returns that specific domain. Wildcard searches use the asterisk (*) to match patterns: 'host:*.example.com' finds all subdomains like api.example.com, mail.example.com, etc. You can use wildcards at the beginning or end: '*.example.com' or 'example.*'. This is crucial for subdomain enumeration and discovering hidden infrastructure.

Is Profundis Hosts Search free?

Yes, Profundis offers a generous free tier that allows multiple searches every day without requiring registration. Free users can access the full search functionality with wildcards and filters. For higher quotas, API access, and real-time alerting, paid subscription plans start at €99/month. All plans include access to the 3.18 billion indexed services.

Why can't I access a host that appears in search results?

There are several reasons: (1) The host may have been discovered in the past and is no longer exposed online - check the scan date on the result card. (2) The host might only be reachable from specific geographic locations due to geolocation routing (like AWS Route53). (3) Profundis uses dozens of servers worldwide; the host may only respond to requests from certain regions. (4) The service may have been taken offline or firewalled since the last scan.

Host Search

Navigate through billions of indexed services

Press Enter to search, Shift+Enter for new line

hostresolutionportprotocoltitle

Try a sample query

See how search works

↵

0 services●0/s ingesting●0 GB

Related tools

Subdomain enumeration

Discover subdomains for a given domain

Hosts details

View complete details and associated data for a host

Analytics lookup

Cross-reference data based on shared analytics IDs

ASN Lookup

ASN lookup to find associated IP ranges and details for an IP