Scanner Allowlisting

Attaxion scans your organization's internet-facing assets to discover exposures and identify vulnerabilities. However, firewalls, web application firewalls (WAFs), intrusion prevention systems (IPS) and intrusion detection systems (IDS) may block scanning requests if they identify them as potentially malicious.

To ensure Attaxion can scan your assets without interference, we recommend allowlisting the scanner's IP addresses.

Attaxion Scanner IP Addresses

Add the following IP addresses and networks to the allowlist of your firewall, WAF, IDS/IPS, or other security solutions:

• 64.140.161.160/29

• 54.67.114.125

• 54.219.123.66

• 2607:f2d8:6064:5::/64

These entries should be configured as trusted source networks.

Make sure the allowlisting rules apply to all relevant security layers, including any third-party CDN, hosting, or bot protection services that handle traffic to your assets.

Attaxion Scanner User Agents

Attaxion's web application scanner may use the following HTTP User-Agent strings when accessing your assets:

• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36

• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36

• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36

We recommend allowlisting Attaxion by source IP address rather than User-Agent alone.

What to Expect During Scanning

When Active scanning is enabled, Attaxion's web application scanner performs a short crawl of your website, followed by non-destructive checks for common vulnerabilities, including SQL injection, cross-site scripting (XSS), command injection, and exposed sensitive files.

Although these checks are designed to be non-destructive, security systems may flag the requests as suspicious and block them.

The web application scanner only runs in Active mode. In Passive mode, Attaxion does not perform these vulnerability checks or send test payloads.

For more information, see Attaxion Scanning Modes: Passive and Active.

What If Scanning Is Still Blocked?

If Attaxion cannot scan your assets successfully after allowlisting the IP addresses, check whether another security layer, such as a CDN, hosting provider, WAF, or bot protection service, is blocking or challenging the requests.

Review your security logs to identify blocked requests and verify that the allowlisting rules apply to the relevant assets and ports.

If the issue persists, contact Attaxion support for assistance.