Skip to main content
Pentest-Tools.com scans originate from a fixed pool of IP addresses. If your firewall, WAF, or IDS/IPS blocks these IPs, scans will fail or return incomplete results. You can whitelist by FQDN (recommended) or by explicit IP address.

​
When to whitelist

Whitelist the scanner IPs if you’re seeing:
  • “Website / URL is not accessible” errors when the site works normally
  • Port scans that return no open ports on a host you know is live
  • Scans that stop before completing without a clear error
Add scanners.pentest-tools.com to your allowlist. This hostname resolves to the current pool of scanner IPs, so it stays accurate as the pool changes.

​
Scanner locations

Scanners operate from data centers in Germany, Italy, and the United Kingdom. If your target enforces geolocation-based access controls, allow traffic from these regions.

​
IP address list

This list changes as scanner capacity expands. Whitelisting scanners.pentest-tools.com is more reliable than a static IP list.

​
VPN profile

When using a VPN profile to scan internal targets, the agent tunnel connects from a separate IP: The agent needs outbound TCP port 22 to vpn2.pentest-tools.com. See VPN profiles overview for setup instructions.

​
Troubleshooting

This error can appear in two places: as a notification before the scan starts (the platform tried to reach the target and failed) or as a finding inside the scan results (the scanner container started but could not connect during testing).Common causes:
  • The target is temporarily down
  • A firewall, WAF, or IP allowlist is blocking the scanner’s source IPs
  • The target restricts traffic by geography (the scanners operate from Germany, Italy, and the UK)
  • The target is on a private network and needs a VPN profile
What to try:
  • Confirm the URL is reachable from a browser
  • Whitelist scanners.pentest-tools.com in your firewall or WAF
  • For internal targets, configure a VPN profile and attach it to the scan
If the scanner reports no open ports on a host you know is running services, firewall filtering is the most common cause. The firewall drops probe packets before they reach any open port, so the scanner sees nothing.Other things to check:
  • Whitelist scanners.pentest-tools.com so probe packets are not dropped before they arrive.
  • If Check alive is enabled and the host does not respond to ICMP or TCP SYN probes, the scan stops before testing ports. Disable Check alive in Custom mode to proceed regardless.
  • The open ports may be outside the default range. Try the Full port range option in Custom mode.
  • Confirm the target IP or hostname is correct.
The alive check sends ICMP echo, TCP SYN/ACK, and UDP probes before scanning. If the host drops all of them, the scanner marks it unreachable and stops.To scan it anyway, disable Check alive in Custom mode. The scanner will attempt port detection without a positive alive signal, and any open ports it finds will still be reported.