Silent Push is a cyber threat intelligence provider that gives early-warning visibility into attacker infrastructure. The Silent Push transforms enrich domains, DNS names, IP addresses, ASNs and name servers directly in Maltego. They return:
- sibling, cousin and typosquatting domains
- SSL/TLS certificates and name server (NS) records of a domain
- Silent Push risk scores for domains and IPv4 addresses
- reputation and takedown reputation scores for ASNs, name servers and IPv4 addresses
- passive DNS (PADNS) forward lookups to IPv4 addresses, IPv6 addresses and DNS names
- open directory data and JARM fingerprints for IPv4 addresses
- raw web scan documents returned by a Silent Push Query Language (SPQL) search
Silent Push Transforms
All transforms use the same API Key setting, described once here. It is a global setting: you enter it once for the Silent Push hub item and it is shared by every transform. If the key is missing, a transform stops with the message "Please input an API key."
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transforms that take extra settings list them in their own section.
---
Domains and DNS names
Find Sibling Domains [SilentPush]
Finds domains that are exactly the same as the original domain, except for the domain name (that is, the same second-level label under a different top-level domain).
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Sibling Domains [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.DNSName, maltego.Domain |
Output Entities | maltego.Domain |
Short Description | Finds domains that are exactly the same as the original domain, except for the domain name. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_sibling_domains | maltego.DNSName, maltego.Domain | maltego.Domain |
Find Cousin Domains [SilentPush]
Returns the cousin domains of the input domain, as determined by Silent Push.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Cousin Domains [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.DNSName, maltego.Domain |
Output Entities | maltego.Domain |
Short Description | Returns the cousin domains of the input domain. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_cousin_domains | maltego.DNSName, maltego.Domain | maltego.Domain |
Find Typosquatting Domains [SilentPush]
Finds typosquatted variations of the original domain. Results are returned page by page and can be narrowed with the filters below. Filters left empty are not sent to Silent Push.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Name Server Name | string list | – | TBC | TBC | false |
Is On Name Servers | boolean | – | TBC | TBC | false |
In Subnet | boolean | – | TBC | TBC | false |
Network | string list | – | TBC | TBC | false |
AS Number | string list | – | TBC | TBC | false |
In ASN | boolean | – | TBC | TBC | false |
AS Name | string | – | TBC | TBC | false |
AS Name Starts With | string | – | TBC | TBC | false |
AS Name Contains | string | – | TBC | TBC | false |
Aggregate By Host | boolean | – | TBC | TBC | false |
First Seen Between | datetime range | – | TBC | TBC | false |
Last Seen Between | datetime range | – | TBC | TBC | false |
How the filters are applied:
- Name Server Name: only the first 5 entries are used. Is On Name Servers switches the match to an exact (equal) match against these name servers.
- Network: only the first 5 entries are used. In Subnet restricts results to addresses inside those networks.
- AS Number: every entry must be a whole number, otherwise the transform stops with an "Invalid ASNUM value" message. In ASN restricts results to those AS numbers.
- AS Name, AS Name Starts With and AS Name Contains filter on the AS name.
- Aggregate By Host: when enabled, results are reduced to one entry per host.
- First Seen Between and Last Seen Between restrict results by the date range in which Silent Push first or last saw the domain.
Transform Meta Info
Information | Value |
Display Name | Find Typosquatting Domains [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.DNSName, maltego.Domain |
Output Entities | maltego.Domain |
Short Description | Finds typosquatted variations of the original domain. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_typosquatting_domains | maltego.DNSName, maltego.Domain | maltego.Domain |
Find Domain Certificate(s) [SilentPush]
Returns the SSL/TLS certificates that Silent Push has observed for the input domain.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Domain Certificate(s) [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.DNSName, maltego.Domain |
Output Entities | maltego.X509Certificate |
Short Description | Returns the SSL/TLS certificates observed for the domain. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_domain_certificates | maltego.DNSName, maltego.Domain | maltego.X509Certificate |
Find NS Records of the domain [SilentPush]
Returns the name servers of the input domain, with their Silent Push reputation details.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find NS Records of the domain [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.Domain |
Output Entities | maltego.NSRecord |
Short Description | Returns the name servers of the domain and their reputation details. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_ns_records_of_the_domain | maltego.Domain | maltego.NSRecord |
Find SilentPush Risk Score for the domain [SilentPush]
Returns the Silent Push risk score of the input domain(s). The score is shown as a text overlay on the domain entity and in its detail view. The transform accepts several domains at once and attaches the scored domain to each input entity.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find SilentPush Risk Score for the domain [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.Domain (one or more) |
Output Entities | maltego.Domain |
Short Description | Returns the Silent Push risk score of the domain(s). |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_silentpush_risk_score | maltego.Domain | maltego.Domain (with risk score overlay) |
---
Passive DNS (PADNS)
All three transforms below run a forward passive DNS lookup. Results are returned page by page and can be restricted by when Silent Push first or last saw the record.
To IPv4 Address [SilentPush]
Returns the IPv4 addresses from a forward lookup of a DNS name.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
First Seen Between | datetime range | – | TBC | TBC | false |
Last Seen Between | datetime range | – | TBC | TBC | false |
Transform Meta Info
Information | Value |
Display Name | To IPv4 Address [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.DNSName |
Output Entities | maltego.IPv4Address |
Short Description | Returns the IPv4 addresses from a forward lookup of a DNS name. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
to_ipv4_from_dns | maltego.DNSName | maltego.IPv4Address |
To IPv6 Address [SilentPush]
Returns the IPv6 addresses from a forward lookup of a DNS name.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
First Seen Between | datetime range | – | TBC | TBC | false |
Last Seen Between | datetime range | – | TBC | TBC | false |
Transform Meta Info
Information | Value |
Display Name | To IPv6 Address [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.DNSName |
Output Entities | maltego.IPv6Address |
Short Description | Returns the IPv6 addresses from a forward lookup of a DNS name. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
to_ipv6_from_dns | maltego.DNSName | maltego.IPv6Address |
To DNSName [SilentPush]
Returns the DNS names from a forward lookup of a domain.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
First Seen Between | datetime range | – | TBC | TBC | false |
Last Seen Between | datetime range | – | TBC | TBC | false |
Transform Meta Info
Information | Value |
Display Name | To DNSName [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.Domain |
Output Entities | maltego.DNSName |
Short Description | Returns the DNS names from a forward lookup of a domain. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
to_dnsname_from_domain | maltego.Domain | maltego.DNSName |
---
IPv4 addresses
Get Silent Push Risk Score [SilentPush]
Returns the Silent Push risk score of the input IPv4 address. The score is shown as a text overlay on the entity and in its detail view, together with the factor that decided the score when Silent Push provides one. No entity is returned if Silent Push has no score for the address.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Get Silent Push Risk Score [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.IPv4Address |
Output Entities | maltego.IPv4Address |
Short Description | Returns the risk score of a given IPv4 address. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
get_ipv4_risk_score | maltego.IPv4Address | maltego.IPv4Address (with risk score overlay) |
Get Open Directory Data [SilentPush]
Returns the open directory data of the input IPv4 address, one file entity per entry found.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Get Open Directory Data [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.IPv4Address |
Output Entities | maltego.File |
Short Description | Returns the open directory data of a given IPv4 address. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
get_ipv4_open_directory_data | maltego.IPv4Address | maltego.File |
Get JARM Fingerprint [SilentPush]
Returns the JARM TLS fingerprints that Silent Push has recorded for the input IPv4 address. Each fingerprint carries its first and last seen dates, and where available the server banner and the domain it was seen with.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Get JARM Fingerprint [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.IPv4Address |
Output Entities | JARM Fingerprint (entity type id TBC) |
Short Description | Returns the JARM Fingerprint of a given IPv4 address. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
get_ipv4_jarm_fingerprint | maltego.IPv4Address | JARM Fingerprint |
Find Reputation score of the IPv4 [SilentPush]
Returns the Silent Push reputation score and details of the input IPv4 address.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Reputation score of the IPv4 [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.IPv4Address |
Output Entities | maltego.IPv4Address |
Short Description | Returns the reputation score of the IPv4 address. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_ip_reputation_score | maltego.IPv4Address | maltego.IPv4Address (with reputation details) |
---
ASNs, organizations and name servers
Find all the ASNs containing the organization name [SilentPush]
Returns the autonomous systems (ASNs) whose name contains the name of the input company or organization.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find all the ASNs containing the organization name [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.Company, maltego.Organization |
Output Entities | maltego.AS |
Short Description | Returns ASNs containing the organization name. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_asn_from_org_name | maltego.Company, maltego.Organization | maltego.AS |
Find Reputation score for ASN [SilentPush]
Returns the Silent Push reputation score and details of the input autonomous system.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Reputation score for ASN [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.AS |
Output Entities | maltego.AS |
Short Description | Returns the reputation score of the ASN. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_asn_reputation | maltego.AS | maltego.AS (with reputation details) |
Find Takedown Reputation score for ASN [SilentPush]
Returns the Silent Push takedown reputation score and details of the input autonomous system.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Takedown Reputation score for ASN [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.AS |
Output Entities | maltego.AS |
Short Description | Returns the takedown reputation score of the ASN. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_asn_takedown_reputation_score | maltego.AS | maltego.AS (with takedown reputation details) |
Find Reputation score for the Name Server [SilentPush]
Returns the Silent Push reputation score and details of the input name server.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Reputation score for the Name Server [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.NSRecord |
Output Entities | maltego.NSRecord |
Short Description | Returns the reputation score of the name server. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
find_nameserver_reputation_score | maltego.NSRecord | maltego.NSRecord (with reputation details) |
---
Raw search
Perform Raw Search [SilentPush]
Runs a Silent Push Query Language (SPQL) query against the Silent Push web scan data. The text of the input phrase is used as the query. Each result is returned as a "Webscan Document" entity. If Silent Push rejects the query, the transform reports the error and asks you to check your SPQL query.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
API Key | string | – | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Perform Raw Search [SilentPush] |
Author | Maltego Technologies GmbH |
Data Source | Silent Push |
Input Entities | maltego.Phrase |
Output Entities | maltego.Document |
Short Description | Performs a raw SPQL search and returns the matching web scan documents. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
perform_raw_search | maltego.Phrase | maltego.Document |
---