> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/external-scan/ip-addresses.md).

# IP addresses and traffic

The IP addresses used by the External Scan cannot be disclosed: they are not static and change regularly, on purpose, to avoid automatic detection or blocking by security systems. This keeps the scans continuous and effective.

{% hint style="info" %}
Stoïk uses the AWS Ireland IP address range to perform external scans. For more details, see the [AWS documentation](https://ip-ranges.amazonaws.com/ip-ranges.json), which lists their IP address ranges.
{% endhint %}

## Allowlisting the scanner

Only the full list of Amazon Ireland IP ranges is available: region `eu-west-1` in the [AWS IP list](https://ip-ranges.amazonaws.com/ip-ranges.json). There is no smaller list.

If you block foreign IP addresses, the scan cannot see your infrastructure, and your results will not reflect your real exposure.

## Checking whether traffic came from the scan

If you saw suspicious traffic or received an abuse complaint:

1. Look up the IP address on [ipinfo.io](https://ipinfo.io). If it does not say Amazon and Dublin, IE, it is not the External Scan (for example, an IP in Frankfurt or at OVH is not Stoïk).
2. Check in Stoïk Protect whether a scan was running at that time.
3. If both match, contact <protect@stoik.io> with the IP address and the date and time, including the timezone.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/prevention-tools/external-scan/ip-addresses.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.