01 / IDENTIFIABLE
Recognizable infrastructure
Scanner addresses use forward and reverse DNS under scanning.silentpush.com. HTTP requests to the range direct operators back to this page.
Internet measurement
Why did Silent Push connect to your system?
Silent Push measures publicly accessible Internet services to help security teams identify malicious infrastructure and emerging threats. This page explains our activity, how to identify it, and how network owners can request an exclusion.
Our approach
Measured with restraint. Operated in the open.
Internet-wide measurement is useful only when it is accountable. We identify our infrastructure, limit interactions to what is needed to characterize public services, and provide network owners with a clear way to contact us.
02 / LIMITED
Protocol-appropriate collection
Our systems connect to public services and collect response metadata needed for security research and infrastructure analysis.
03 / RESPONSIVE
A path for network owners
If our traffic creates an operational concern, you can report it or request that verified address ranges be excluded from future measurement.
Collection boundaries
What our scanners do—and do not do.
Our measurement systems are designed to observe public-facing infrastructure without attempting to obtain privileged access or change remote systems.
Our scanners may
- Determine whether a publicly routed IP and port responds.
- Perform a limited handshake appropriate to the detected protocol.
- Collect service banners, certificates, headers, and related public metadata.
- Revisit services to keep observations current.
- Use observations to identify infrastructure relationships and security risks.
Our scanners are not intended to
- Guess passwords or attempt to authenticate to services.
- Exploit vulnerabilities or bypass access controls.
- Modify, delete, or intentionally disrupt remote systems.
- Deploy software or establish persistence.
- Collect information that requires privileged access.
Identify us
Confirm the traffic in your logs.
Use the source range and DNS convention below to distinguish Silent Push measurement traffic. Forward and reverse records should agree for active scanner addresses.
- IPv4 source range
148.59.129.0/24- Hostname pattern
148-59-129-<octet>.scanning.silentpush.com- Example
148.59.129.10↔148-59-129-10.scanning.silentpush.com- Verification
dig -x 148.59.129.10dig A 148-59-129-10.scanning.silentpush.com- General contact
- abuse@silentpush.com
Network owners
Request an exclusion.
If you control a network that should not receive Silent Push measurement traffic, prepare an opt-out request below. We may ask you to verify authority over the listed prefixes before applying the exclusion.
List the exact public CIDR ranges to exclude.
Provide organizational contact information.
Submit the generated request through our contact channel.
Common questions
Scanning FAQ
Additional questions or unexpected traffic can be reported through the Silent Push contact page.
Why was my system contacted?
Your address appears to be publicly routable, and a service may have responded on a port included in our measurement activity. A connection does not mean that Silent Push believes the system is compromised.
Does Silent Push attempt to log in?
Our measurement scanners are not intended to guess credentials or authenticate to services. They collect information available through unauthenticated, protocol-appropriate interactions with public-facing services.
Will opting out remove historical observations?
An exclusion is intended to stop future active measurement of verified ranges. Historical observations may remain in existing datasets, research, or security records. Contact Silent Push if you have a specific data-handling question.
How do I report unexpected or disruptive behavior?
Use the Silent Push contact page and include the source and destination IPs, destination port, protocol, timestamps with timezone, and a short packet or log sample. Those details help us identify the responsible system quickly.