Silent Node: how a pay-first «offshore host» fakes its way to your deposit
Silent Node sells anonymous offshore servers, but its live status page is drawn with random numbers, its company and history do not check out, and every door — servers, support, even a pre-sales question — opens only after a deposit into a balance with no withdrawal. We walked through it as a user, without paying.
Silent Node presents itself as an anonymous offshore host: a 16-digit token instead of an account, servers in fifteen «privacy jurisdictions», crypto only. It entered our watch list on 8 October, like every service we observe before our catalog opens. On 25 October it was flagged in review, and we went through it as a customer would, stopping only at the moment of paying. What follows is what we saw, and what we checked behind it.
The scheme, step by step
1. A site that looks like a mature provider. Thirty-one languages, product pages for VPS, dedicated, GPU and object storage, a status banner reading «All systems operational · 0 incidents · 99.99% uptime · 31,815 checks/min — LIVE», and «13,068 machines online, counted live by the status API».
2. An account in one click. You get a 16-digit token and a warning: lose it and «your account and balance are gone forever». No email, no recovery. That is normal for privacy services — and it is also a ready explanation for any balance that later disappears.
3. Every door opens only after a deposit. The order page lists plans from $6.99 a month, but a server is «paid straight from your crypto balance». Support tickets — including the Sales category for pre-sales questions — answer «You need money in your balance to open a ticket». The reseller programme asks you to «add at least $25 so we can open your application». There is no trial and no way to ask anything before paying.
4. The deposit page is the bait. Top-ups come with a bonus: $50 becomes $75, $100 becomes $175, $250 or more becomes $500. The money goes to a balance that «never expires». Nowhere does the site say how to take it back out.
5. A «payment processor» that is their own page. The top-up leads to «BDK Pay — Crypto processor, Secured by BDK Pay», hosted on Silent Node’s own domain (app.silentnode.host/pay/…), with a 60-minute countdown and a Monero address. We found no public trace of a processor called BDK Pay.
6. A referral reward for bringing others. $10 for every referred account that tops up at least $25 — an incentive to praise the service in places where new users look.
What is drawn, and how we checked
| What the site shows | What we checked | What we found |
|---|---|---|
| «Live» latency per region, changing every few seconds | the site’s own status.js | the numbers are moved by ±1 ms with Math.random() in your browser |
| «Telemetry» and «checks/min» from a status API | the API endpoint | a synthetic random walk between 503 and 535, not measurements |
| Support reply time | the same page, loaded twice a minute apart | «within ~8 h», then «within ~4 h» |
| 99.99% uptime | our own monitor, 72 days | 82.9% |
| «Since 2021 · Silent Node OÜ · Estonia» | RDAP; Estonian e-Business Register | domain registered 22 July 2026; no company of that name found |
| Founder «kern» with a PGP fingerprint | keys.openpgp.org, keyserver.ubuntu.com | the key is on neither |
| «48-hour money-back guarantee» (later «7-day») | the Terms of Service and refund pages linked at sign-up | both return 404 |
| 13,068 machines, owned EPYC hardware in 15 regions, B300 GPUs | the domain’s age and the company’s traces | an anonymous three-month-old domain behind Cloudflare |
Who sends people to it
Two «hand-curated directories», kycnothanks.com and nokycdirectory.com, rank Silent Node first in hosting, «Featured, 10/10», «the reference no-KYC host». They use the same tagline, were registered on the same day (31 May 2026) at the same registrar, and sit on the same pair of Cloudflare nameservers — which Cloudflare assigns per account. That points to one operator for both; we have not proven who it is, so we keep them on a private watch list rather than in the public registry. Around Silent Node they list well-known honest services, which makes the ranking look credible.
Were we the first?
As far as we can find, nobody had published the scheme before. A LowEndTalk thread a month ago asked «is this for real?» and got a one-line «yes» about a site created in July 2026, and Scamadviser gives the domain a trust score of 0 from automated checks. We found no write-up of how it works, no entry in other directories’ scam lists, and no reports in phishing blocklists. That is why we publish this in full.
What we did
- Took Silent Node off our watch list for good and made the review page of any removed service unreachable.
- Removed it from our comparison of no-KYC VPN, hosting and eSIM services, in all four languages.
- Added it to our scam registry with nine pieces of evidence and their sources, and to our public scam-domain feed.
- Reported both of its domains to MetaMask, Google Safe Browsing, Chainabuse and PhishTank, and warned other directories.
This is what the observation period before launch is for: every service is watched, measured and checked for weeks before it can be listed. On paper, Silent Node’s own claims and the directories praising it looked convincing; our uptime measurements and a walk-through as a customer did not. Our checks now also look for the signals below.
How to spot this pattern elsewhere
- Live numbers that are drawn, not measured — counters that change between two loads, status pages with no history you can verify.
- A history older than the domain — «since 2021» on a domain from this summer.
- An identity you cannot check — a company name missing from the register it claims, a PGP key that no keyserver knows.
- Everything behind a deposit — no trial, no pre-sales answer, no partner programme until you pay.
- Bonuses on deposits into a balance with no withdrawal, and a countdown on the payment page.
- Terms and refund pages that do not exist, while the home page promises your money back.
- Uptime claims far above what an independent monitor sees.
- Rankings from directories nobody had heard of, especially when several of them look alike.
If you already paid
Write down the transaction ID, the amount, the address you paid to and the time. Report the address and the domain on Chainabuse. Do not pay anyone who offers to «recover» the funds for a fee — that is the next scam in line. If you have a ticket or chat history with them, keep it; we will add verified losses to our records if you send them through the contact page.