Skip to main content

IP Whitelisting for Thunders

Written by Ines

Overview

To enable Thunders AI-powered testing platform to access and test your web application, you may need to whitelist our IP addresses depending on your security configuration. This document outlines when IP whitelisting is required and provides the necessary IP addresses for each of our testing locations.

When IP Whitelisting is Required

You'll need to whitelist Thunders IP addresses in the following scenarios:

1. Firewall Restrictions

  • Your web application is protected by a firewall that blocks traffic from unknown IP addresses

  • Corporate firewalls with strict inbound/outbound traffic policies

  • Cloud-based security groups (AWS Security Groups, Azure NSGs, GCP Firewall Rules) with restrictive access rules

2. Geographic Access Controls

  • Your application implements geo-blocking or geo-fencing restrictions

  • Content delivery networks (CDNs) with geographic access limitations

  • Regional compliance requirements that restrict access to specific countries or regions

3. Rate Limiting and DDoS Protection

  • Web Application Firewalls (WAF) like Cloudflare, AWS WAF, or Akamai with aggressive rate limiting

  • DDoS protection services that may flag automated testing traffic as suspicious

  • API rate limiting that could block our testing requests without proper IP recognition

4. IP-Based Authentication

  • Applications that use IP-based allowlisting as part of their authentication mechanism

  • B2B platforms that restrict access to known client IP ranges

  • Admin panels or staging environments with IP-based access controls

5. Corporate Network Access

  • Applications hosted on private corporate networks

  • VPN-protected environments that require specific IP ranges

  • Intranet applications with network-level access restrictions

6. Compliance and Security Policies

  • Applications in regulated industries (finance, healthcare, government) with strict access controls

  • SOC 2, ISO 27001, or other compliance frameworks requiring IP allowlisting

  • Zero-trust security models with explicit IP-based access policies

7. Load Balancer and Reverse Proxy Configurations

  • Load balancers configured with IP-based routing or filtering

  • Reverse proxies (nginx, Apache) with IP restriction modules

  • API gateways with IP-based access control policies

Web & API

These addresses apply to web Test Cases and API Call steps.

If you'd like to perform all of your tests from 1 single location (example Amsterdam), you can whitelist only that specific IPs.

Important : you need to whitelist all the IPs in the location list.

Paris

●	52.143.181.242 
●	4.211.250.23

New York

●	52.143.181.242 
●	172.191.3.80 
●	172.191.83.95

San Francisco

●	52.143.181.242 
●	20.253.217.92 
●	20.66.8.190

Mobile

Mobile Runs execute on real devices hosted in two zones: Europe and United States. Each device in the Device Catalog belongs to one zone, and the traffic of a Mobile Run comes from the zone of its device.

Whitelist the ranges of the zone your devices belong to. To cover every device, whitelist both zones. The ranges are in CIDR notation.

Europe

●	217.112.145.88/29 
●	149.6.5.8/29

United States

●	209.58.137.40/29 
●	137.174.189.0/26

Testing Connectivity

Once you've whitelisted our IP addresses, you can verify connectivity by:

  1. Checking your application logs for successful requests from Thunders IPs

  2. Running a preliminary test in the Thunders platform

  3. Monitoring your firewall/WAF logs to ensure our requests aren't being blocked

This document is updated regularly. Please check back for the latest IP addresses and requirements.

Did this answer your question?