- Company
Silent Push Inc. ©2025
Scanning the public web and dark web for ransomware infrastructure in Silent Push Community Edition
If you’re an independent security researcher, blogger, or part of a security team conducting initial investigations, Silent Push Community Edition is a free threat hunting tool that gives you the ability to locate and traverse malicious infrastructure across the public internet (“clear web”) and dark web simultaneously, and uncover hidden domains and IPs for further investigation.
In this blog, we’ll take a quick look at how we used Silent Push Web Scanner to scan .onion and public sites for DragonForce infrastructure, and the different ways you can query the Silent Push scan data repository to achieve laser-focused datasets.
Sign-up for a free Community Edition account
Silent Push Community Edition is a free threat hunting and cyber defense tool featuring a range of advanced queries and lookups – built on a powerful first-party database of enriched DNS and web content data – that allows users to locate known and hidden threat infrastructure on the public web and dark web.
What is Silent Push Web Scanner?
Silent Push Web Scanner provides historical insight into how threat actors build, manage and deploy their infrastructure over time, through syntax-based queries built on 200+ parameters, including:
- HTML titles
- SSL certificates
- Favicons
- JavaScript files
- Geolocation data
- Proprietary server and certificate hashes
- Body SSDeep data
- On-page content hashes
Crucially, our Web Scanner also provides the capability to uncover malicious threat infrastructure across both the clear web and the dark web, all within a single query.
We scan and collect dark web and public web data into separate repositories, but you can combine these data sources into one query and hunt for infrastructure across both, using the same parameters.
Revealing hidden ransomware portals
Let’s take a look at a quick example of how you can use Web Scanner to conduct dark web and public web scans side by side.
DragonForce is a cybercriminal group that has transitioned from its origins as a Malaysian-based hacktivist collective into a prominent Ransomware-as-a-Service (RaaS) operation.
Initially known for politically motivated attacks, the group has shifted its focus toward financially driven cyber extortion. DragonForce’s RaaS model provides affiliates with customizable ransomware payloads and infrastructure support, facilitated by access infrastructure across the public and dark web.
1. .onion HTML title query
We can use Web Scanner to execute a query using the datasource and htmltitle parameters, that returns .onion sites with matching content that contains “*DragonForce*” in the page title.
2. Pivot onto the clear web and dark web
From the dataset, we know that certain components of DragonForce utilizes the Nuxt.js application.
We can take this intel and use the header.x-powered-by parameter to search for infrastructure using Nuxt across both the public and dark web:
Join our Community Edition workshop on June 10: Scanning Dark Web Infrastructure to Detect Hidden Threats with Silent Push. Register today.
Web Scanner use cases
Web Scanner isn’t limited to public and dark web ransomware scanning. Here’s a few other key use cases that can be fulfilled with scanning via a free Community Edition account:
1. Tracking and stopping brand impersonation attacks
Cybercriminals often set up domains that mimic legitimate brands to deceive users. Web Scanner allows analysts to identify these malicious domains by analyzing patterns in SSL certificates, favicon usage, and HTML structures.
By detecting these behavioral patterns, organizations can take swift action to protect their brand reputation and customers.
2. Mapping attacker infrastructure over time
Web Scanner provides historical datasets that reveal how threat actors evolve their infrastructure over time, helping analysts to anticipate future threats and adapt their defense strategies accordingly.
3. Identifying DNS vulnerabilities
You can use Web Scanner to assess the security posture of a public DNS presence or supply chain operation.
By scanning for exposed services, outdated software, or misconfigurations, organizations can identify and mitigate potential vulnerabilities that could be exploited by attackers.
Ready to take threat hunting to the next level? Book a demo today.
Ready for deeper intel, IOFA feeds, TLP:Amber reporting, seamless integration capabilities and more? See the power of the Silent Push Enterprise Edition — book a demo today.
Preemptive Cyber Intelligence with Indicators of Future Attack™
This datasheet outlines how Silent Push provides preemptive cyber threat intelligence through our proprietary Indicators of Future Attack™ (IOFA™), enabling organizations to detect and stop malicious infrastructure before attacks occur. By leveraging IOFA™, TTP-led analysis, and real-time data enrichment, Silent Push empowers proactive threat hunting, brand protection, and early threat detection.
Ready to dive deeper into the world of preemptive threat intelligence? Begin your journey with the Silent Push free Community Edition today.
Know First with Indicators of Future Attack™
Discover attacker infrastructure before it’s weaponized.
This document highlights how Silent Push empowers SOC, IR, and CTI teams with preemptive threat intelligence using Indicators of Future Attack™ (IOFA™) to detect attacker infrastructure before it’s weaponized. It includes real-world use case examples demonstrating how IOFA™ enables early detection of threats from groups like Lazarus and TA569, helping organizations proactively defend against advanced malware and reduce false positives.
Ready to dive deeper into the world of preemptive threat intelligence? Begin your journey with the Silent Push free Community Edition today.
Intelligence On-Demand
Critical insights, training and research.
This document presents Silent Push’s Intelligence On-Demand service, which provides tailored threat intelligence, IOFA™ updates, and expert-led training to help organizations strengthen security posture and reduce analyst burnout. Featuring flexible support options and insights from seasoned threat hunters, it equips teams with the tools and knowledge to detect and block threats faster—supported by real-world impact and customer testimonials.
Ready to dive deeper into the world of preemptive threat intelligence? Begin your journey by booking a demo with our platform experts.
Threat Actor Study
This report reveals how attackers are evolving, why preemptive intelligence is critical, and how Silent Push tracks hidden threats, disrupts attackers, and sets the gold standard for IOFA™.
You’ll explore:
- The evolving threat landscape – key threats, emerging trends, and AI-driven attacks.
- Technical insights of APTs, major crimeware families, and malicious infrastructure trends.
- Actionable recommendations for organizations and forecasts for 2025.
Access today:
Ready to dive deeper into the world of preemptive threat intelligence? Begin your journey with the Silent Push free Community Edition today.
White Paper 2025
Prevent a breach instead of reacting to it using preemptive threat intelligence with leading-edge Indicators of Future Attack (IOFA)™.
- How to easily track millions of hidden malicious infrastructure
- Know the top threat trends for 2025
- Gain a deeper understanding of financially motivated adversaries including FIN7 and Triad Nexus
Access today:
Ready to dive deeper into the world of preemptive threat intelligence? Begin your journey with the Silent Push free Community Edition today.
Silent Push Launches Chrome Extension, Providing New Controls and Quick Access to Critical Data to Preemptively Stop Attacks
New, strategic integration partnerships available that enhance capabilities and empower SOC, IR and CTI teams
Reston, VA., May 21, 2025 – Silent Push, a leading preemptive cybersecurity intelligence company, announced today the launch of its new Google Chrome Extension, providing immediate access to information about indicators discovered through a user’s browser and new controls to action on them.
As part of the company’s continuing efforts to level up security teams’ cyber defenses, Silent Push introduces new integration partner Filigran – the developer of OpenCTI. Silent Push partnerships, including ThreatConnect continue to improve the customer experience and enhance company-wide security stacks with enriched data from the Silent Push platform.
“The Silent Push Chrome Extension makes it a lot easier to access actionable, and high-quality threat intelligence. It’s easy to use and improves our ability to detect and respond to threats including quick pivots into the Silent Push platform for a deep dive into adversary infrastructure.” — Simone Filiaggi, Sr. Threat Intelligence Analyst, box
Ken Bagnall, CEO and Co-Founder of Silent Push said “We are committed to providing our customers with the solutions and resources they need to protect themselves from an attack and maintain business resilience,”
“Our Chrome Extension is bidirectional and makes it easier and faster to action. It acts as an integration into any of your SaaS platforms. By working directly in your browser through our extension, security teams now have the power to pivot control anywhere on the Internet. Through our integration partnerships and upcoming Abuse Reporting service, we are strengthening our capabilities and commitment so that security teams have the resources they need to identify adversary infrastructure before an attack is launched”, Ken Bagnall said.
“As a new integration partner, our joint customers will benefit from our better together offering of leading threat intelligence from Silent Push leveraged through our OpenCTI platform featuring comprehensive visualizations and analytic tools. This is the best of both worlds to fully enable security teams to protect their organization.” — Jan Johansen, SVP Global Alliances, Filigran, the developer of OpenCTI
“Our long-standing integration partnership with Silent Push enables our joint customers to further their journey towards a fully threat and risk-informed cyber defense. The new Chrome Extension, which offers defenders a far faster time to detect emerging threats, is a great example of the innovation the industry has come to expect from Silent Push.” — Andrew Pendargast, Chief Product Officer, ThreatConnect
Traditional IOC-based security models are such a reactive approach that limit security teams from proactively stopping an attack that is yet to launch. Attackers are faster, more automated and increasingly leverage modern techniques to evade detection. A more modern approach is needed.
Indicators of Future Attack (IOFA)™–only available from Silent Push–replace the traditional model providing an cyber early warning system. And, now with its Chrome Extension, Silent Push empowers Incident Response, Threat Intelligence and SOC teams to swiftly act and protect their organization with preemptive technology accessible with a simple click.
Currently, the Silent Push Chrome Extension is available to enterprise customers only and downloaded here within the Chrome Web Store.
Book A Demo
The Silent Push Chrome Extension is available to Enterprise users with an API key. Book a quick demo to see how upgrading can help you uncover attacker infrastructure smarter, faster, and with more confidence.
Introducing the Silent Push Chrome Extension
The Silent Push Chrome Extension allows you to scan, extract, save, and analyse DNS and web content data in Silent Push Enterprise direct from a Chrome window, without switching between tools or tabs.
Security teams and researchers can use the extension to gather Indicators of Future Attack™ (IOFA™) intelligence from a browser, and connect the dots between what they see in Chrome, and what Silent Push knows about any given threat landscape (hint: a lot).
Whether you’re investigating an unknown threat, reviewing security alerts in a SaaS platform, or reading a piece of threat research, our Chrome extension provides instant and actionable insight into any domains, IPs, and URLs you encounter online.
Install now from the Chrome Web Store
What does it do?
Our extension transforms your browser into a real-time proactive threat intelligence console. Once installed and connected using your Silent Push API key, you’ll be able to:
- Scan any indicator (domain, IP, or URL) without leaving your browser window
- Extract all on-page DNS data displayed on any website you visit
- Execute Total View lookups to reveal the origin, function, and risk level of any given indicator
- Get live screenshots of active domains
- Initiate scans to see how websites behave in real time, or how infrastructure has changed over time
- View any indicators that appear in Silent Push IOFA™ (Indicators of Future Attack™) Feeds
- Save indicators to your feeds, or create new feeds from fresh intelligence
- Submit abuse reports on suspect domains
How does it work?
Installation is simple. Once you’ve downloaded the extension, add it to Chrome and input your Silent Push API key to connect it to your Enterprise account.
Capturing Indicators
From there, you can begin scanning indicators immediately, using the following methods:
- Right-click on any highlighted domain, IP, or URL and choose “Scan Indicator”
- Enter an indicator manually into the search bar
- Click “Collect DNS Data” to retrieve all DNS records on the page
Our extension is designed to make actionable intelligence discovery as fast and intuitive as possible. Instead of copying data from emails, internal tools, or browser windows into another system, you can act immediately to validate any indicators you encounter.
It’s all about speed, context and ease of use.
For example, if you’re reviewing a suspicious link in your email client, highlight it and right-click to ascertain its risk level. Browsing a complex and lengthy threat intelligence report that analyzes output from multiple pivot points? Scrape all on-page DNS data in one click. SOC teams can also use the extension to get instant insight on unknown indicators across any number of SaaS platforms they use (and we know it’s a lot!).
Saving Data
Once you’ve scanned an indicator, you can use the “Save To” feature to retain and act on what you’ve found.
Indicators can be added to an existing feed for active monitoring and correlation, or new feeds that create TTP-specific watchlists of fresh intelligence, and early investigations.
All of this allows analysts to turn passive browsing into meaningful intelligence gathering. Instead of letting key indicators slip through the cracks, you can preserve and escalate them for ongoing visibility and collaboration across your team.
Silent Push Total View
The main piece of functionality is being able to gain instant DNS insight into an indicator, using Silent Push Total View – a CTI “landing page” for investigations into unknown infrastructure.
The main summary panel provides immediate visibility into active DNS resolutions, risk level, and the context surrounding any scanned indicator, including:
- The indicator’s Silent Push Risk Score
- The indicators presence in any IOFA™ Feeds
- DNS infrastructure analysis (A, MX, TXT, CNAME etc.)
- WHOIS data, such as domain age, registrar, and registration date
- Variance in infrastructure that might indicate malicious use
One click away from the extension, from any data point, takes you into the full Silent Push platform for advanced investigations.
Live Scan
To evade detection, threat actors recycle through DNS infrastructure at a rapid rate. When time is of the essence, knowing what a domain is doing right now is crucial.
That’s where Live Scan comes in. The Live Scan tab provides a real-time look at how a piece of infrastructure is configured, how it’s presented to the public, and what content it’s hosting.
When you initiate a Live Scan in the extension, you receive:
- A live screenshot of the webpage
- A true/false indicator for active A records
- Page title and favicon information
- HTML response content
- A real-time risk score
You can even input a domain or URL manually, without browsing to the website itself, allowing you quickly identify active threats without having to navigate to a potentially dangerous site.
Web Scanner
Web Scanner allows you to track the automated management and deployment of attacker domains and IPs, by executing searches using 150+ parameters per webpage, that reveal traceable behavioral fingerprints linked to specific adversaries and attack vectors.
This is especially useful for campaign attribution, threat actor tracking, uncovering shared hosting infrastructure, and revealing how a threat actor has adjusted their TTPs over time to evade detection.
Using powerful syntax-based content and DNS queries, built on a proprietary query language, you can discover deployment patterns, identify related infrastructure, and establish a behavioral fingerprint that follows an attacker across the Internet.
Actionable SOC and IR intelligence, direct from your browser
Most threat intelligence workflows involve copying and pasting indicators across separate system for cross-team analysis. That process creates delays, breaks concentration, and sometimes results in missed opportunities.
The Silent Push Chrome Extension changes that. By embedding proactive DNS and web content intelligence functionality into your browser, it allows analysts to:
- Act on threats as they encounter them
- Enrich data instantly with a wealth of context
- Avoid the platform-switching roundabout that slows down investigations
- Save and monitor key indicators over time
- Accelerate triage, abuse reporting, and frontline decision-making
It’s not just about convenience – it’s about enabling earlier (and more effective) detection, and faster response.
Common Use Cases
Here’s just a few ways analysts are using the extension:
- Email Security Teams: Right-click to scan suspicious links in phishing emails
- SOC Analysts: Investigate domains in alerts, without switching platforms
- Threat Hunters: Discover and track attacker infrastructure live on the web
- Brand Protection Teams: Identify and report fraudulent domains that are spoofing your online presence
- Security Researchers: Run Live Scans on emerging campaigns and malware delivery sites
Download now on the Chrome Store
The Silent Push Chrome Extension is currently available to Enterprise users only.
- Connect it using your API key
- Start scanning in seconds
Learn more about our unique approach to preemptive threat intelligence
Find out how Silent Push helps you to locate hidden and known threat infrastructure, and stop digital assaults at the source before they occur with Indicators Of Future Attack (IOFA)™ data.
Contact us here for more information.