Access requirements

XBOW’s testing infrastructure originates from specific IP addresses. Configure your firewall or web application firewall (WAF) to allow traffic from the addresses used by XBOW console.

IP addresses used by XBOW

Most users access XBOW at: https://console.xbow.com. This application and all its data is hosted in the USA.

Alternative locations are available as a private preview to Enterprise users. Talk to your XBOW contact if you want information about joining the private preview of data residency in the European or Asia-Pacific regions.

Default IP addresses

If you access XBOW at console.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

  • 13.59.171.92
  • 18.220.171.27
  • 3.131.87.64
  • 3.137.71.91
  • 3.18.165.130
  • 3.21.131.137
  • 3.21.217.89
  • 3.22.165.38

For advanced firewall configurations that support hostname-based rules, you can use DNS entries.

DNS hostnameResolved IP address
attack-1-1.deployment.eng.xbow.com18.220.171.27
attack-1-2.deployment.eng.xbow.com3.131.87.64
attack-1-3.deployment.eng.xbow.com13.59.171.92
attack-1-4.deployment.eng.xbow.com3.18.165.130
attack-2-1.deployment.eng.xbow.com3.22.165.38
attack-2-2.deployment.eng.xbow.com3.21.217.89
attack-2-3.deployment.eng.xbow.com3.21.131.137
attack-2-4.deployment.eng.xbow.com3.137.71.91

Note: DNS entries may have a time-to-live (TTL) of approximately 280 seconds. Ensure your firewall configuration accounts for DNS caching behavior.

European data residency (private preview)

If you access XBOW at console.eu.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

  • 3.64.160.172
  • 52.28.99.241
  • 3.68.124.109
  • 18.158.18.103

Asia-Pacific data residency (private preview)

If you access XBOW at console.sg.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

  • 3.0.113.115
  • 54.255.59.25
  • 54.251.146.176
  • 54.254.193.118

Alternative access methods

If you cannot configure IP-based access, see Configure your server to allow XBOW requests for alternative methods such as custom bypass headers.