Network abuse & probe addresses

What you are seeing

PingFleet is an uptime monitoring service. Our customers ask us to check that their own servers are reachable, so our probes send small, low-rate requests to addresses those customers specified:

• ICMP echo: ordinary pings. The payload is filled with the text pingfleet.net, so a packet capture identifies us without a lookup.
• TCP connections to a single specified port, opened and closed.
• HTTP(S) requests to a specified URL, sent with the user agent PingFleet/1.0 (+https://pingfleet.net/abuse), which is the line in your access log that brought you here.
• TLS handshakes to read a certificate's expiry date.

We never send more than one check per monitor per interval, the shortest of which is five seconds. We do not scan address ranges, we do not sweep ports, and we do not attempt authentication. A check that fails is simply recorded as a failure and reported to the customer.

Why it can look like scanning. A TCP check to an unusual port is, at the packet level, indistinguishable from the first packet of a port scan. That is a real limitation of the protocol, not a euphemism. The difference is the pattern: one port, one host, on a fixed interval, from a fixed address that publishes what it is, which is what the rest of this page is for.

Our probe addresses

These are the only addresses our checks originate from. They are also available as JSON and as a plain list if you want to pull them into a script. Reverse DNS for each resolves under pingfleet.net.

Traffic to us, for example a customer's heartbeat, may arrive from other addresses, because that side sits behind a CDN. The list above is specifically the addresses our outbound checks come from, which is what you would put in an allow list.

Getting excluded

Email [email protected] with the address or hostname being checked. We will stop checking it and tell the customer why. You do not need to prove ownership to be excluded. We would rather stop and ask than argue about it.

If it is urgent, say so in the subject. If you already have an abuse ticket open with our hosting provider, include the ticket reference and we will answer there too.

Reporting something worse

If you believe one of our addresses is doing something beyond the above, high-rate traffic, authentication attempts, anything that looks like an attack, please tell us at [email protected] and include a packet capture or log excerpt with timestamps and time zone if you can. A probe behaving that way is either broken or compromised, and either way we want to know within minutes, not on the next business day.