Access requirements

XBOW’s testing infrastructure originates from specific IP addresses. Configure your firewall or web application firewall (WAF) to allow traffic from the addresses used by XBOW console.

Domains used by XBOW

XBOW uses two top-level domains:

• xbow.com is the product surface, and includes the Console, the API, and the documentation.
• xbow.ltd is XBOW-owned infrastructure used during assessments for purposes like egress traffic, out-of-band callbacks, and test helper domains.

Seeing both domains in your logs, request payloads, or attack strings during an assessment is expected.

IP addresses used by XBOW

Most users access XBOW at: https://console.xbow.com. This application and all its data is hosted in the USA.

Alternative locations are available as a private preview. Talk to your XBOW contact if you want information about joining the private preview of data residency in Australia, Canada, Europe, Japan, or Singapore. For more information, see Meet data residency requirements.

Default IP addresses

If you access XBOW at console.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

• 13.59.171.92
• 18.220.171.27
• 3.131.87.64
• 3.137.71.91
• 3.18.165.130
• 3.21.131.137
• 3.21.217.89
• 3.22.165.38

For advanced firewall configurations that support hostname-based rules, you can use DNS entries.

Note: DNS entries may have a time-to-live (TTL) of approximately 280 seconds. Ensure your firewall configuration accounts for DNS caching behavior.

Australian data residency (private preview)

If you access XBOW at console.au.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

• 13.238.229.178
• 54.153.245.53
• 13.236.105.79
• 54.206.87.68

Canadian data residency (private preview)

If you access XBOW at console.ca.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

• 15.222.56.77
• 16.54.54.109
• 15.175.153.88
• 15.175.140.216

European data residency (private preview)

If you access XBOW at console.eu.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

• 3.64.160.172
• 52.28.99.241
• 3.68.124.109
• 18.158.18.103

Japanese data residency (private preview)

If you access XBOW at console.jp.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

• 176.34.19.0
• 54.238.19.223
• 35.72.228.118
• 18.176.30.191

Singapore data residency (private preview)

If you access XBOW at console.sg.xbow.com, update your server configuration to allow traffic from these IP addresses during testing.

• 3.0.113.115
• 54.255.59.25
• 54.251.146.176
• 54.254.193.118

Verify IP addresses for your XBOW Console

If you access XBOW Console at a different hostname, or you want to confirm the current attack IP addresses, you can check them yourself.

In the console

1. Log in to your XBOW Console.
2. Next to your organization name at the top of the page, click the arrow icon to open the organization menu.
3. Select Security Settings.
4. Check the IP addresses on the Reachability card.

Via the API (requires administrator access)

Call GET /api/v1/meta/addresses with an API key against the Console host for your environment. To learn how to generate a key and which headers you need to send, see Accessing the API.

curl -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-XBOW-API-Version: <current-version>" \
  https://<your-console-host>/api/v1/meta/addresses

The response lists the live attack IP addresses for your organization:

{
  "agents": ["<ip>", "<ip>"]
}

Alternative access methods

If you cannot configure IP-based access, see Configure your server to allow XBOW requests for alternative methods such as custom bypass headers.