Trustlist requirements for the EU region
Invicti Platform makes network connections that may require updates to your firewall settings. Configure inbound and outbound traffic rules to allow access to the URLs in this document. Correctly configuring network access is a prerequisite for successful and accurate scans of your targets. For more information about what happens when trustlisting isn't configured, see Consequences of scanning without trustlisting.
These are the trustlist configuration steps to consider:
-
Inbound connections
- Your target accepting inbound connections
- Your integration server accepting inbound connections
-
Outbound connections
- Your browser outbound connections
- Invicti Platform internal scanning agent outbound connections
- NTA Reconstructor outbound connections
- Target Application outbound connections
Inbound connections
Your target accepting inbound connections
Ensure your target's network infrastructure allows incoming scanning requests from:
| Scope | EU-based customers | Address and Port |
|---|---|---|
| Incoming scanning requests from the cloud scanners | scanners-platform-eu.invicti.com (3.79.201.172) | Your target's address and port |
| Incoming scanning requests from the internal scanners | IP Address of your Internal Scanning Agents | Your target's address and port |
| Predictive Risk Scoring | 52.0.216.190 | Your target's address and port |
| PCI ASV scans | 38.123.140.0/24 | Your target's address and port |
Your integration server accepting inbound connections
Ensure your integration server's network infrastructure allows incoming connections for integration API calls.
| Scope | EU-based customers | Port |
|---|---|---|
| Integration API calls | 3.69.209.29 18.194.203.224 | 443 |
If you have a dedicated environment, ensure access to the environment accordingly.
Outbound connections
Your browser outbound connections
Your browser might be behind an outbound firewall or web proxy, especially when connected to a corporate LAN or VPN. Ensure that your firewall, proxy, or VPN allows outbound connections to the Invicti Platform URL for your location.
| Scope | EU-based customers | Port |
|---|---|---|
| Browser access to Invicti Platform | https://platform-eu.invicti.com | 443 |
Invicti Platform internal scanning agent outbound connections
If you have deployed an internal scanning agent, ensure your network infrastructure permits it to establish outbound connections to the following destinations:
| Scope | EU-based customers | Port |
|---|---|---|
| Invicti Platform | https://platform-eu.invicti.com | 443 |
| Invicti OOB service for out-of-band vulnerability checking | https://bxss.me | 443 |
| Safe browsing service | https://sb.bxss.me | 443 |
| Software composition analysis service | https://sca.invicti.com | 443 |
| Invicti OOB S3 bucket for out-of-band vulnerability checking | https://poll.bxss.me | 443 |
| Downloading agent update packages | https://registry.invicti.com | 443 |
| Invicti IAST Bridge | https://iast.invicti.com | 443 |
| Scanning requests to your target | IP Address/URL for your target | Your target's port |
NTA Reconstructor outbound connections
If you have deployed the NTA Reconstructor, ensure your network infrastructure permits it to establish outbound connections to the Invicti APIHub Service URL:
| Scope | EU-based customers | Port |
|---|---|---|
| APIHub Service URL: NTA Reconstructor communication with Invicti Platform | https://platform-eu.invicti.com/api/apihub/v1/nad | 443 |
Target Application outbound connections
If you have deployed an Invicti IAST agent in your target web application, ensure your network infrastructure permits it to establish outbound connections for API calls to the Invicti IAST Bridge URL for your location.
| Scope | EU-based customers | Port |
|---|---|---|
| Injected payload calls to the Invicti OOB service to provide evidence of out-of-band vulnerability detection. | https://bxss.me | 443 |
| *API Calls to the IAST Bridge | https://iast.invicti.com | 443 |
API rate limits
If you are using the Invicti Platform API, note that rate limits apply per client IP address and per tenant. See Handle responses: Rate limits for the full thresholds and guidance on handling 429 responses.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center.