> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scan-access-and-connectivity/scanner-ip-address.md).
# Scanner IP address
The scanner IP addresses used by Snyk API & Web
Snyk API & Web uses the following IP addresses to make requests to your targets and to receive out-of-band connections from them.
## Target scans
Customers hosted in US infrastructure:
* **18.235.241.170** (AWS IP)
Customers hosted in AU/APJ infrastructure:
* **52.65.214.19** (AWS IP)
* **13.237.213.25** (AWS IP)
All other customers:
* **52.19.40.38** (AWS IP)
## Asset discovery
Customers hosted in US infrastructure:
* **44.205.45.120** (AWS IP)
Customers hosted in AU/APJ infrastructure:
* **3.104.172.219** (AWS IP)
* **13.211.189.220** (AWS IP)
All other customers:
* **52.16.191.244** (AWS IP)
If you are unsure where your account is hosted, check all IP addresses or contact the support team for assistance.
If you have your own single-tenant or dedicated infrastructure, contact the support team.
## Out-of-band vulnerability checks
Some vulnerabilities, such as Log4Shell, can only be confirmed when the affected system connects to an external server. Snyk operates dedicated servers to receive these callbacks. Unlike the addresses above, these servers receive connections from your systems rather than sending requests to them.
Customers hosted in US infrastructure:
* **szpus.prbly.win** resolving to **52.72.180.55** (AWS IP)
Customers hosted in AU/APJ infrastructure:
* **szpau.prbly.win** resolving to **52.62.50.85** (AWS IP)
All other customers:
* **szp.prbly.win** resolving to **52.17.201.157** (AWS IP)
These servers accept connections on TCP ports 53, 80, 443, and 389, and on UDP port 53.
Allow both the hostname and the IP address. Because the connection originates inside your own network and carries test payloads, some firewalls and threat intelligence tools categorize the domain as malicious and redirect it. For example, Palo Alto DNS sinkholing resolves it to sinkhole.paloaltonetworks.com. Allowing the IP address alone does not resolve this; the domain must also be allowed.
These connections are optional. If you block them, Snyk API & Web cannot verify the vulnerabilities that depend on them.
## Related information
You can also identify Snyk requests through the user-agent header. For more information, visit [Identify scanner requests](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scan-access-and-connectivity/identify-scanner-requests.md).
If you use a Web Application Firewall (WAF) in front of your target, it can block scan requests from Snyk IP addresses and cause the scan to fail. To avoid that, visit [Configure IPs in WAFs](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scan-access-and-connectivity/configure-ips-in-wafs.md).
If you use a Farcaster Scanning Agent, see the full network requirements, including tunnel and container registry access, in the [Farcaster Scanning Agent README](https://github.com/Probely/farcaster-onprem-agent#network-requirements).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scan-access-and-connectivity/scanner-ip-address.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.