IP Addresses for Pentest
Aikido uses dedicated IP addresses and request headers to perform pentesting of your environment. To prevent connectivity issues, rate limiting, or security blocks, add these IPs and headers to your firewall’s allowlist or other security software.
Which IPs should you allowlist?
Pentest traffic comes from the region where your Aikido workspace is hosted, not from the region where your application runs. Check the URL you use to log in to Aikido, then allowlist that region's IPs:
| Aikido URL | Region | IP list |
|---|---|---|
| app.aikido.dev | EU | EU-based IP addresses |
| app.us.aikido.dev | US | US-based IP addresses |
| app.au.aikido.dev | AU | AU-based IP addresses |
| app.me.aikido.dev | ME | Coming soon |
If you log in at app.aikido.dev, connectivity checks and the pentest itself use EU IPs, even when your endpoints are hosted in the US. Allowlisting only US IPs in that case will cause the pentest to fail.
IP Addresses
EU-based IP addresses (app.aikido.dev)
- 34.252.102.184
- 52.48.122.82
- 52.49.182.62
- 52.209.168.11
- 52.210.210.125
- 54.76.103.212
- 54.194.175.200
- 54.217.255.121
US-based IP addresses (app.us.aikido.dev)
- 3.226.27.188
- 34.237.95.50
- 44.209.154.183
- 52.204.120.162
- 54.80.175.207
- 54.227.161.94
- 98.88.145.68
- 98.91.68.215
AU-based IP addresses (app.au.aikido.dev)
- 13.237.12.233
- 13.55.70.235
- 15.134.62.222
- 15.135.1.99
- 3.105.20.219
- 3.24.155.132
- 52.64.105.187
- 54.253.33.136
Optional IP addresses
Used for troubleshooting with support.
- 79.127.239.171
Request Headers
All requests from Aikido's pentesting include one of the following value for the User-Agent header. These can be used to identify pentest requests in your SIEM or WAF request logs.
aikido-pentest-agentaikido-pentest-agent/1.0 (Agent <AGENT_UUID>)
For instructions on whitelisting IP addresses with third-party providers, refer to the following resources:
- Cloudflare WAF
- Cloudflare Turnstile does not support allowlisting specific client IP addresses. If you need to bypass Turnstile for Aikido scanning traffic, you must do it in your application code. We recommend bypassing only when both conditions are true:
- The request originates from an Aikido IP range
- The request includes the
aikidoUser Agent in headers as described above
- Cloudflare Turnstile does not support allowlisting specific client IP addresses. If you need to bypass Turnstile for Aikido scanning traffic, you must do it in your application code. We recommend bypassing only when both conditions are true:
- Azure WAF
- AWS WAF.
- For WAFs behind Application Load Balancers or CloudFront, your WAF should check the last IP address in the
X-Forwarded-Forheader.
- For WAFs behind Application Load Balancers or CloudFront, your WAF should check the last IP address in the
- Vercel WAF
- Use the "bypass" action for trusted IPs
Testing Internal Applications
If your application is hosted on a strictly private network, VPN, or intranet that cannot accept inbound traffic from the public internet, pentest it through the Aikido Broker. Install the broker inside your network, register the internal URLs, and add them with Add Broker Domain in the assessment wizard. Inbound allowlisting is not required.
The Broker requires installing an agent in your infrastructure. Use it when standard IP allowlisting is not possible. Install steps are in Aikido Broker for Internal Applications.