Scoring

Details about scores in Silent Push API

A brief overview of different scores available in API responses

Domain related scores

age_score

• based on the age of the domain as seen in DNS zone files

• a more recently created domain scores higher

is_new_score

• the is_new_score is 100 if the domain has been created within the last 24 hours

• newly created domains represent a higher risk when observed in network traffic

dga_probability_score

• indicates the likelihood that the domain name is the result of a Domain Generating Algorithm

url_shortener_score

• 100 if the domain is a known url shortener service

• scored alternative to the is_url_shortener flag

listing_score

• shows if the domain has previously been seen on any of a selection of highly trusted threat intelligence feeds

• the score is graded based on recency and frequency of prior listings

ns_reputation_score

• reputation score for the name servers currently associated with this domain

• name server reputation is based on the number of domains hosted on the name server versus the number of those domains listed in threat intelligence feeds

ns_entropy_score

• an indication of frequency and recency of historic changes of name servers for this domain

• more frequent and/or recent name server changes may add to levels of suspicions about the domain

sp_risk_score

• the Silent Push Risk Score provides an at-a-glance assessment of the risk associated with this domain

• the sp_risk_score is equal to the highest of the following scores, but will be reduced to 0 if any of these flags is true: is_expired, is_parked, is_sinkholed

  • ns_entropy_score, ns_reputation_score, is_new_score, age_score, listing_score

IPv4 related scores

asn_rank_score

• a weighted measure of the type of feed where IPv4 addresses in this ASN have been listed

• listings on malware feeds are counted with a higher weight than listings on phishing feeds, for example

• all ASNs with listings are ranked against each other

asn_reputation_score

• a measure of IPv4 addresses in this ASN that have been listed on certain feeds

• the score reflects volume rather than severity

• the reputation score is calculated as a logarithmic ratio of listed vs active IPv4 addresses in the ASN, where an active IPv4 address is any IP with a current A record in Silent Push Passive DNS

asn_takedown_reputation_score

• a measure of how long it takes for malicious URLs to be taken down by the ISP abuse desk

• we only count URLs that have a minimum age of X days and the aggregation is the number of items/URLs listed

• the total count of items listed is then compared to the total number of IPs in the ASN using a specific formula

• all ASNs with listings are ranked against each other

ip_is_dsl_dynamic_score

• 100 if the IPv4 address is part of dynamically allocated/residential IP space

• scored alternative to the ip_is_dsl_dynamic flag

listing_score

• shows if the IPv4 address has previously been seen on any of a selection of highly trusted threat intelligence feeds

• the score is graded based on recency and frequency of prior listings

subnet_reputation_score

• a measure of IPv4 addresses in this subnet that have been listed on certain feeds

• the score reflects volume rather than severity

• the reputation score is calculated as a logarithmic ratio of listed vs active IPv4 addresses in the subnet, where an active IPv4 address is any IP with a current A record in Silent Push Passive DNS

ip_reputation_score

• a measure of the number of DNS A record names resolving to this IPv4 address and that have been listed on certain feeds

• the score reflects volume rather than severity

• the reputation score is calculated as a logarithmic ratio of listed names (A records) vs all active A records resolving to this IPv4 address, where an active A record is any current A record in Silent Push Passive DNS

sp_risk_score

• the Silent Push Risk Score provides an at-a-glance assessment of the risk associated with this IPv4 address

• the sp_risk_score is equal to the highest of the following scores, but will be reduced to 0 if any of these flags is true: known_benign, known_sinkhole_ip

  • ip_reputation, subnet_reputation, asn_reputation, asn_takedown_reputation, asn_rank, listing_score