# IP Addresses for Pentest

Aikido uses dedicated IP addresses and request headers to perform pentesting of your environment. To prevent connectivity issues, rate limiting, or security blocks, add these IPs and headers to your firewall’s allowlist or other security software.

## IP Addresses

### **EU-based IP addresses**

* 52.48.122.82
* 54.194.175.200
* 52.210.210.125
* 54.76.103.212
* 54.217.255.121
* 52.49.182.62
* 34.252.102.184
* 52.209.168.11

### **Optional IP addresses**

Used for troubleshooting with support.

* 79.127.239.171

## Request Headers

All requests from Aikido's pentesting include one of the following headers, which can also be used for allowlisting:

* `aikido-pentest-agent`
* `aikido-pentest-agent/1.0 (Agent <AGENT_UUID>)`

## Third party provider instructions <a href="#third-party-provider-instructions" id="third-party-provider-instructions"></a>

For instructions on adding IP addresses to allowlists with third-party providers, refer to the following resources:

* [Cloudflare WAF](https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/)
  * Cloudflare Turnstile does not support allowlisting specific client IP addresses. If you need to [bypass Turnstile for Aikido scanning traffic, you must do it in your application code.](https://developers.cloudflare.com/turnstile/tutorials/conditionally-enforcing-turnstile/) We recommend bypassing only when both conditions are true:
    1. The request originates from an Aikido IP range
    2. The request includes the `aikido` User Agent in headers as described above
* [Azure WAF](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview)
* [AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html).
  * For WAFs behind Application Load Balancers or CloudFront, your [WAF should check the last IP address in the `X-Forwarded-For` header](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.html).
* [Vercel WAF](https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules)
  * Use the ["bypass" action](https://vercel.com/docs/vercel-firewall/firewall-concepts#bypass) for trusted IPs

{% hint style="info" %}
[The IP address lists are also available as JSON arrays ](https://aikido.help/ips/)
{% endhint %}

## Testing Internal Applications

If your application is hosted on a strictly private network, VPN, or intranet that cannot accept inbound traffic from the public internet, you can use the [aikido-broker-for-internal-applications](https://help.aikido.dev/~/revisions/SGhJfnCIOpxRjx1gC1k5/miscellaneous-info/aikido-broker-for-internal-applications "mention")

{% hint style="info" %}
The Broker requires installing an agent in your infrastructure. We recommend this only when standard IP allowlisting is not possible.
{% endhint %}