How We Map Dormant Blocks: Passive Scanning, Explained
No exploits, no authentication, no intrusive traffic. Passive TCP probing is the polite way to ask 4.3 billion addresses whether they are home.
What "passive" actually means
Passive scanning is the equivalent of knocking on a door and waiting for an answer — then leaving. A TCP-connect probe opens a connection to a port; if something answers, the port is open; if not, it is silent. No malformed packets, no exploits, no guessing passwords.
The rules we follow
IPDORM probes with strict rate limits, refuses private and reserved ranges, stores only infrastructure-level data (never end-user IPs) and stops when an operator asks. This keeps us on the legal side of every jurisdiction we operate in, in line with TCK 243 in Türkiye and comparable computer-misuse laws elsewhere.
Why it is enough
You do not need deep reconnaissance to find dark space. You need a consistent answer to one question: does this block answer on common service ports? Repeat that across millions of addresses on a rolling schedule and the silent blocks emerge by themselves.
The result is a living map: registered blocks that respond to nothing. That is the raw material for every IPDORM signal — transfer candidates, lease candidates, abuse watchdogs.