Scanner Infrastructure

Scanner IP Addresses

Whitelist these IP addresses on your perimeter firewall, WAF, and cloud security groups to allow DevSecOps Platform scans against your protected targets.

Active Telemetry Scanner IPs

95.216.235.154Active

EU-Central (Germany - Primary) Web + Network Scanner

OWASP ZAP, Nmap, Nikto, testssl.sh, Nuclei

How to Whitelist

To scan targets protected by a firewall, WAF, or cloud security group, allow inbound traffic from our scanner IP. Follow instructions for your architecture below.

AWS Security Group

AWS CLI

aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxx \
  --protocol tcp \
  --port 443 \
  --cidr 95.216.235.154/32

Replace sg-xxxxxxxx with your security group ID.

Cloudflare WAF

Go to Security → WAF → Tools in your Cloudflare dashboard
Under IP Access Rules, create a new rule
Value: 95.216.235.154
Action: Allow
Zone: Select your domain or All Zones

Nginx Reverse Proxy

/etc/nginx/conf.d/scanner-allow.conf

# Allow DevSecOps Platform scanner
location / {
    allow 95.216.235.154;
    # ... your existing deny rules
}

Linux Firewall (UFW / iptables)

UFW

sudo ufw allow from 95.216.235.154 to any port 443
sudo ufw allow from 95.216.235.154 to any port 80

iptables

sudo iptables -A INPUT -s 95.216.235.154 -j ACCEPT

Important Verification Notes

•IPs are static and pinned. We provide at least 30 days advance notification before any infrastructure IP changes.
•Only whitelist the scanner IP for targets you own or have written authorization to test.
•Verify reverse DNS before whitelisting: dig scanner.harshal.cloud
•Your active scanner IP is also reflected on the VAPT Dashboard for rapid copy-pasting.

Need Assistance?

If scans are blocked or you experience firewall issues, contact support@harshal.cloud with your target hostname and network details.