How to Whitelist KinoSec's Scanning IP

Step-by-step instructions to whitelist our scanning IP on Cloudflare, AWS WAF, and other platforms so your pentests run at full capability.

All KinoSec pentest traffic comes from a single static IP address. If your website sits behind a WAF (Web Application Firewall), CDN, or firewall, it may block our requests and you'll end up with incomplete findings. Whitelisting our IP ensures full pentest coverage.

Our Scanning IP

46.101.120.244

Add this IP to your WAF or firewall's allowlist using the platform-specific instructions below.

Cloudflare

Cloudflare is the most widely used reverse proxy and WAF. The recommended method is a WAF custom rule with the Skip action, which bypasses managed rules, rate limiting, and bot protection.

Steps

  1. Log in to your Cloudflare dashboard and select your domain.
  2. Navigate to Security → Security rules (or Security → WAF → Custom rules in the classic dashboard).
  3. Click Create rule.
  4. Set the expression: Field = IP Source Address, Operator = equals, Value = 46.101.120.244.
  5. Under Choose action, select Skip.
  6. Tick all three skip options:
    • All managed rules
    • All rate limiting rules
    • All Super Bot Fight Mode rules
  7. Click Deploy.

View Cloudflare documentation →

Cloudflare gotchas

  • Bot Fight Mode (Free plan) runs in a separate pipeline and cannot be skipped via rules. If you're on the Free plan with Bot Fight Mode enabled, toggle it off during the pentest: Security → Settings → Bot traffic → Bot fight mode → Off.
  • IP Access Rules (the older "Allow" method) are no longer recommended and don't reliably skip Managed Rules. Use the custom rule method above instead.
  • Custom rules with Skip are available on all Cloudflare plans, including Free.

AWS WAF / CloudFront

If your site is behind Amazon CloudFront with AWS WAF, create an IP set and exclude it from managed rules.

Steps

  1. In the AWS WAF console, go to IP sets → Create IP set.
  2. Name it (e.g., KinoSec-Scanner), choose Global (CloudFront) as the region if your web ACL protects a CloudFront distribution, and add 46.101.120.244/32.
  3. Go to Web ACLs → select your web ACL → Rules.
  4. For each managed rule group: select it → Edit → Scope of inspection → Only requests that match a scope-down statement → If a request doesn't match the statement (NOT) → Inspect: Originates from IP address in → select your IP set → Source IP address.

Alternatively, add a custom Allow rule referencing the IP set with a lower priority number than your managed rule groups.

View AWS WAF documentation →

AWS gotchas

  • The IP set must use Global (CloudFront) scope to work with CloudFront distributions. Regional IP sets won't attach.
  • If using the Allow rule approach, ensure it has a lower priority number (evaluated first) than managed rule groups.
  • Bot Control and Fraud Control are separate paid rule groups. Scope them down separately if active.

Other Platforms

Platform How to whitelist Official docs
Fastly (Next-Gen WAF) Sites → select site → Rules → Create site rule → IP equals 46.101.120.244 → Action: Allow Fastly rules docs
Akamai Add IP to a Network List, then apply via Bypass Network Lists (WAP) or match-target exception (AAP) Akamai AppSec docs
Sucuri Access Control → Whitelist IP Address → enter IP → Allow. This is a full WAF bypass. Sucuri allowlist docs
Azure Front Door WAF policy → Custom rules → Add rule → Match type IP address, variable RemoteAddr, value 46.101.120.244 → Action Allow at top priority Azure WAF IP restriction
Google Cloud Armor Cloud Armor policy → Rules → Add rule → Match 46.101.120.244 → Action Allow at low priority number Cloud Armor policies
F5 Distributed Cloud Load Balancer → Common Security Controls → Trusted Client Rules → identify by IP. Skips Bot Defense + WAF. F5 trusted client rules

General Guidance

If your platform isn't listed above, create a custom security rule that:

  1. Matches our IP 46.101.120.244.
  2. Sets the action to Allow or Skip.
  3. Is placed at the highest priority (lowest number) so it's evaluated first.
  4. Covers managed WAF rules, bot protection, and rate limiting. A simple IP allowlist often does not skip all layers.

Verify It's Working

After applying the allowlist rule, run a pentest on your asset. If you see more findings or improved coverage compared to previous pentests, the whitelisting is working correctly.

You can remove the rule after the pentest completes if you don't want a permanent exception. Leaving it in place ensures consistent results on future pentests.