scan.pqprobe.com

What runs from 159.69.181.191, and how to opt out.

What this IP does

The IP 159.69.181.191 originates scans for pqprobe.com, a measurement of post-quantum readiness in TLS deployments on the public internet. Each scan cycle, the scanner makes two kinds of short-lived connection to a small published target list:

• HTTPS, port 443. One TLS ClientHello, full handshake, then close. We record the negotiated TLS version, cipher suite, key-exchange group, and certificate signature algorithm.
• SMTP STARTTLS, port 25. Read banner, EHLO, STARTTLS, TLS handshake, then close. We record the same TLS parameters as above.

What this IP does not do

• No MAIL FROM, no RCPT TO, no DATA. The SMTP session ends at the TLS handshake. The scanner never reaches the mail-content stage of the protocol and never delivers mail.
• No authentication attempts. No AUTH, no credential probing, no STARTTLS-downgrade testing.
• No vulnerability exploitation. The handshake itself is the measurement.
• No port sweeps. Only the two ports above, and only against hosts on the published list.
• No payload retention beyond the TLS parameters listed above. Banners and EHLO responses are not published.

Cadence and load

One cycle every 24 hours. The current target list is under 1,500 hosts. Per-host load is one connection per cycle.

Identifying this traffic in your logs

Source IP

159.69.181.191

Reverse DNS

scan.pqprobe.com

HTTPS SNI

the target hostname

SMTP EHLO host

scan.pqprobe.com

Why this scan exists

Post-quantum cryptography is being added to TLS implementations now because adversaries can record encrypted traffic today and decrypt it later, once cryptographically relevant quantum hardware exists. Knowing whether public TLS deployments actually negotiate post-quantum key exchange, as opposed to merely supporting it in their crypto library, requires connecting to those deployments and observing the handshake. That measurement is what runs from this IP.

Operator

pqprobe is operated by Davi Ottenheimer.

The scanner is closed source. Its behavior, the ports it touches, and what it records are described on this page and at pqprobe.com/docs; questions about either go to the address below.

Opt out

To remove a host or network from the scanner, email abuse@pqprobe.com with the hostname, IP, or CIDR. No account, form, or repository access is needed; the email address is the whole process.

What happens then:

• The entry is added to the scanner's exclusion list.
• Scanning of that host or network stops within one scan cycle, 24 hours, of the next deployment.
• The exclusion is permanent unless you write again to reverse it.

You do not need to explain why, and a request from anyone operating the address is honored without further checks.

If you are reporting suspected abuse rather than requesting an opt-out, the same address reaches the operator directly.

Why publish this page

Mail and web operators reading their logs deserve a way to identify unfamiliar inbound connections and a working path to stop them. Publishing the operator, the scope, and an opt-out address turns an unidentified scanner into a known, accountable one. This page is the canonical reference; if anything here is unclear or out of date, write to the address above.

Last updated 2026-07-27.