Scanner IP addresses
Every BestDefense scan reaches your site from one of three fixed IP addresses. If your site sits behind a firewall, WAF, CDN, or IP allowlist, add all three before you run a scan.
The addresses
Section titled “The addresses”3.132.137.903.23.106.1973.130.143.162All three are in AWS us-east-2 (Ohio). They are static — they do not change when
our infrastructure is redeployed.
Add all three, not just one. A scan uses whichever address its scanner task happens to start behind, and you cannot predict or pin which. Allowing only one means roughly two scans in three will be blocked.
When you need this
Section titled “When you need this”| Situation | Do you need to allowlist? |
|---|---|
| Public site, no WAF or firewall rules on inbound traffic | No |
| WAF or CDN in front of your site (Cloudflare, AWS WAF, Akamai) | Usually yes — see below |
| Security group, firewall, or load balancer restricted to known IPs | Yes |
| Staging or pre-production site restricted to your office IP | Yes |
| Rate limiter that blocks bursts from a single address | Recommended — see below |
What it looks like when it’s missing
Section titled “What it looks like when it’s missing”A scan against a site that is blocking us fails with a message like:
We could not connect to the target URL. Please verify the URL is correct and the site is publicly reachable, then try again.
This is easy to misread, because the site is usually working perfectly in your browser at the same moment. Your browser is coming from your own address, which your firewall already allows; our scanner is not. If a scan reports a site unreachable that you can load yourself, an IP restriction is the first thing to check.
Rate limiters and WAFs
Section titled “Rate limiters and WAFs”Allowlisting by IP is not always enough. Many hosts — particularly shared hosting and CDN edge protection — will start refusing requests from any single address that sends too many too quickly, allowlisted or not. When that happens a scan reports:
The target is rate-limiting our scanner (HTTP 429). This is not an issue with your site — please try the scan again in a few minutes.
Our scanner paces itself and slows down when it detects this — see how fast Vortex scans — but it cannot always avoid a limiter with a low threshold. If you control the limiter, exempting the three addresses above for the duration of a scan gives the most complete results.
A scan that fails this way is free to re-run; see when a scan fails.
Scanning from your own network
Section titled “Scanning from your own network”The addresses on this page apply to Vortex web application scans. Network scans that use the installed agent run from inside your own environment and do not come from these addresses — see Installing the agent.