Mast probes
Last updated 18 October 2026
If you found this in your logs, one of our customers is watching a URL on your server. Mast checks it every so often and pings their phone if it stops answering. The requests carry this user agent:
tissue-probe/1 (+https://tissue.systems/mast/probes)
Where they come from
These machines send the checks. A single check can come from two or three of them at the same moment, so you may see the same request arrive from different places a few milliseconds apart.
- Los Angeles (us-w)
172.96.161.2162605:9880:200:20::117EHLO probe-us-w.tissue.systems- Kansas City (us-c)
69.42.222.102001:4858:aaaa:161::3EHLO probe-us-c.tissue.systems- Chicago (us-c-2)
64.177.121.1422001:19f0:5c00:44c1:5400:6ff:fea0:470fEHLO s40.us-c.tissue.systems- Beauharnois, Quebec (ca-e)
51.79.9.1302607:5300:203:5a5a::10EHLO probe-ca-e.tissue.systems- Vint Hill, Virginia (us-e-2)
40.160.87.2112604:2dc0:121::122cEHLO s41.us-e.tissue.systems- Northern Virginia (us-e-3)
100.60.89.1292600:1f18:4d9f:5f00:3d20:9e9c:1188:b460EHLO probe-us-e-3.tissue.systems- Nuremberg (eu-c)
167.233.186.1472a01:4f8:1c18:fe2::10EHLO probe-eu-c.tissue.systems- Frankfurt (eu-c-2)
3.67.117.02a05:d014:1486:7400:78b8:b1df:8495:6665EHLO probe-eu-c-2.tissue.systems
If you'd rather feed a firewall than copy from this page, there's a plain list at /mast/probes.txt and a JSON version at /mast/probes.json. When we add a machine, its address goes on this page before it sends anything, and the date at the top changes.
What we actually send
For a web check it's one GET or HEAD to the exact URL the customer typed in. We follow up to three redirects, wait 10 seconds at most, and stop reading after 256 KiB. On HTTPS we also look at when the certificate expires, but no more than once every six hours.
For a port check we open a TCP connection to the host and port they gave us. Most port checks close it straight away. If the customer asked for a reply, we read the first thing your server says, or send one short line they wrote (1 KiB at most) and read the answer, then close. We never read more than 4 KiB.
For a DNS check we ask a public resolver for one record, so your nameservers see the resolver, not us. For a ping check we send three ICMP echo requests.
The fastest anyone can check is every 30 seconds, and most checks run less often than that. If a check fails, we try again 10 seconds later before we tell anyone.
That's all. We don't crawl, follow links, try other paths or ports, or poke at anything looking for holes. We won't check private or internal addresses either.
Checks also stop by themselves. If a URL hasn't answered for a week, we pause it. If nobody has signed in to an account for 90 days, we pause all of its checks.
Mail servers
A mail check connects to the host and port the customer gave us and reads your greeting. Depending on what they asked for, it may also say EHLO and try STARTTLS. Then it says QUIT. We never send MAIL FROM or RCPT TO, and we never deliver anything.
Each machine says the name listed next to it above in EHLO, and that name resolves back to the machine's IPv4 address. If you'd like to let our checks in, allow those addresses or those names in whatever decides who gets a 220.
If your server refuses us, that's fine. The customer sees the probe as refused, not down, and nobody gets paged over it.
On port 25 we check at most once every 5 minutes, whatever the customer's plan allows, because mail servers rightly throttle and blocklist addresses that connect to port 25 too often. Port 587 has no such limit.
If you want us to stop
Email abuse@tissue.systems with the domain or IP, and we'll stop checking it, no matter which customer set it up. A person reads that inbox, and you don't have to give a reason.