Reputation query tools in Silent Push help security teams, threat hunters, and researchers quickly assess the trustworthiness of network elements such as ASNs, IPv4 addresses, subnets, and nameservers. These tools provide reputation scores and takedown metrics based on historical data, malicious links, and security practices — letting you prioritize threats, spot risky infrastructure, and defend against phishing, malware, and other attacks.
How to Check ASN Reputation Score
Quick Purpose: Rates an ASN's trustworthiness based on past malicious activity, threat-involved IPs, and security measures.
From the left navigation menu, select Advanced Query Builder > Reputation Queries.
Enter the ASN (e.g.,
AS12345).Run the query to view the reputation score.
Optional: Use the “explain” feature for a detailed breakdown of the score calculation.
How-To Use Case: Prioritizing Monitoring for High-Risk ASNs
Query an ASN suspected of hosting threats.
If the score is low (e.g., below 50), flag all associated IPs and domains for enhanced monitoring.
Set up SIEM alerts for traffic originating from this ASN.
Result: Proactively block or investigate phishing and malware campaigns early.
How to Evaluate ASN Takedown Reputation
Quick Purpose: Measures how quickly a provider responds to abuse reports and mitigates threats.
From the left navigation menu, select Advanced Query Builder > Reputation Queries.
Input the ASN (e.g.,
AS67890).Execute the query to get the takedown reputation score.
Optional: Use “explain” to see historical responsiveness data.
How-To Use Case: Choosing Reliable Hosting Partners
Query ASNs of potential cloud or hosting providers.
Prefer providers with high takedown scores (80+).
Avoid or add extra controls for low-scoring ASNs.
Result: Reduce risk of prolonged exposure to malicious activity.
How to Assess IPv4 Reputation Score
Quick Purpose: Evaluates an individual IP (or range) based on links to threats via DNS, hosting, or traffic patterns.
From the left navigation menu, select Advanced Query Builder > Reputation Queries.
Enter the IPv4 address or range (e.g.,
192.168.1.1).Run the query to retrieve the reputation score.
Optional: Enable “explain” for threat linkage details.
How-To Use Case: Blocking Suspicious IPs
Query an IP appearing in recent logs or alerts.
If the score is low, immediately add it to firewall blocklists.
Cross-reference associated domains for further action.
Result: Prevent phishing pages or malware delivery from reaching users.
How to Measure Subnet Reputation Score
Quick Purpose: Scores an entire subnet or IP range to identify broader malicious patterns early.
From the left navigation menu, select Advanced Query Builder > Reputation Queries.
Provide the subnet and netmask (e.g.,
192.168.1.0/24).Run the query for the reputation score.
Optional: Use “explain” to review the underlying factors.
How-To Use Case: Focusing Resources on High-Risk Subnets
Query subnets linked to unusual or suspicious traffic.
Prioritize low-score subnets for in-depth investigation.
Allocate monitoring or isolation resources accordingly.
Result: Efficient threat mitigation without spreading resources too thin.
How to Check Nameserver Reputation Score
Quick Purpose: Rates nameservers based on historical activity, malicious domain associations, and security practices.
From the left navigation menu, select Advanced Query Builder > Reputation Queries.
Enter the nameserver hostname (e.g.,
ns1.example.com).Run the query to obtain the reputation score.
Optional: Use “explain” for calculation details.
How-To Use Case: Spotting Risky Domains Early
Extract nameservers from a suspicious domain’s WHOIS or DNS records.
Query the nameserver reputation.
If low, investigate or block all domains it serves.
Result: Detect phishing or malware infrastructure before it becomes active against your organization.
How to Save Query
Specify query parameters.
Click Save Query.
Provide a Name and Description for context.
Click Save. The query appears in Private Queries.
How-To Use Case: Streamlining Team Threat Hunting
Save common reputation queries (e.g., known bulletproof ASNs).
Share with analysts for daily or incident-specific checks.
Update saved queries as threat landscapes evolve.
Result: Faster, consistent team workflows.
How to Integrate Reputation Queries
Quick Purpose: Automate reputation checks in SOAR platforms or custom scripts.
Connect Silent Push via API to tools like Splunk SOAR or Cortex XSOAR.
Use the API endpoint to fetch reputation scores programmatically.
Parse JSON responses containing scores and metadata.
How-To Use Case: Automated Alert Enrichment
Add a Silent Push API call to your SOAR playbook.
Automatically query IPs, subnets, or ASNs from incoming alerts.
Use the returned score to auto-triage (e.g., escalate low-score hits).
Result: Faster incident response with enriched context.
Example API Response:
Querying subnet 192.168.1.0/24 might return:
Reputation Score: 70 (moderate trustworthiness)
Metadata: List of associated domains, historical malicious activity
Tip
Combine reputation scores with other Silent Push queries (e.g., PADNS or feed data) for even higher-confidence threat detections.