Probe IP addresses

Checks are sent from fixed IPv4 addresses. If your service sits behind a firewall, a WAF or an IP allowlist, allow the addresses of the regions your monitors use — otherwise a check is refused before it reaches your service and the monitor reports a failure (often a 403 or a timeout) that your users do not see.

Addresses per region

Region code	Location	Source addresses	Host
fr-dc3	Paris	51.159.96.198, 51.159.96.191, 195.154.218.97	Scaleway
de-fra	Frankfurt	94.237.95.125	UpCloud
es-mad	Madrid	87.58.157.186	UpCloud
uk-lon	London	51.68.206.174	OVHcloud
nl-ams	Amsterdam	94.237.6.169	UpCloud
pl-waw	Warsaw	81.27.103.142	UpCloud

Paris has three addresses because its probe runs on the platform cluster: a check leaves from whichever of the three nodes the probe is on. Allow all three.

Every other region currently sends its checks from 51.68.206.174 (London), until it gets a probe of its own. This page is updated before any address changes.

All addresses are IPv4. Probes do not check over IPv6.

Alert webhooks

Alert deliveries (webhooks, Alertmanager, chat integrations) are sent by the platform, not by the probes. They come from the three Paris addresses above. If the endpoint that receives your alerts filters by IP, allow those three.

What to allow

• HTTP, TCP, gRPC, mail and database monitors: inbound connections from the region’s addresses to the monitored port.
• Ping monitors: ICMP echo requests from the region’s addresses.
• Private targets: an address that is not reachable from the Internet cannot be checked from a public region, allowlist or not — use a private agent inside your network.

Checking that a failure is an IP block

Open the monitor and look at the failed checks: the same target answering 200 from one region and 403 (or timing out) from another is the signature of an IP filter. Compare the failing region with the table above.