Centinel AnalyticaForestEngine
ForestEngine is the internet-wide scanning infrastructure behind Forest, a search engine for internet scan data operated by F.O.R.E.S.T. L.L.C. It probes a fixed list of ports on publicly reachable services and records TLS certificates, response headers, service banners, and the home page plus the site icon a web port returns, and states that it does not follow links, walk a site, or keep a list of paths to try. The operator declares a single scanning range of 151.245.151.0/24 and documents no reverse DNS hostnames, but none of the traffic observed on this platform came from that range: over a fourteen day window all 142 requests arrived from 135 distinct addresses in unrelated hosting ranges, so the declared range does not identify this agent and the user agent cannot be trusted as proof of origin.
At a glance
- Operator: F.O.R.E.S.T. L.L.C.
- Type: Security
How Centinel checks it
- User agent: The request calls itself this crawler. Anyone can send the same string.
ForestEngine publishes nothing Centinel can check a source against, so a match reports the name and leaves the source unconfirmed. The match tokens, verification domains, and address feeds are not published here.
Allowing or blocking it
The crawler object in the /validate response sets access_allowed to true only for a verified source that your tenant allowlists. A policy rule can allow or block this crawler by its category, Security.