What "Unreachable" means

Topscan checks every target it scans. If the domain doesn't resolve, or nothing answers on any port, the target gets the Unreachable outcome:

  • The target is skipped. An empty result wouldn't reflect your real exposure, so nothing is published for it.
  • Your existing issues and Security Score for the target are unchanged: a skipped target is a gap in coverage, not a fix.
  • Other targets in the same scan are scanned normally.
  • The scan page shows example.com is unreachable (with your target's name), the facts behind the outcome, and the addresses to allow. You also get an email the first time a target becomes unreachable.

From the outside, a host that is down and a host that silently drops our packets look the same. That's why the message always names both causes. Check them in this order.

1. Check the host

  • Is the address spelled correctly? A typo in the target points to a host that doesn't exist.
  • Does the domain still resolve? If the DNS record was removed or changed, Topscan can't find the host. In this case the scan page says the target has no A/AAAA record.
  • Is the host online and open to the internet? Try opening it from a network outside your office or VPN.

If one of these is the cause, fix it and run the scan again.

2. Allow the Topscan scanner IP addresses

If the host is online and opens fine for you, something in front of it is blocking Topscan: a WAF, CDN, firewall, rate limiter or an intrusion-prevention tool such as fail2ban. Allow connections from these addresses on every such layer:

Address
173.0.155.112
173.0.155.134

Scans can come from any of them, so allow the full list. If the list ever changes, we'll announce it in advance.

How to allow the addresses

Add an exception for the Topscan addresses only. Don't switch off the WAF or lower protection for everyone else.

Cloudflare

  1. Open your domain in the Cloudflare dashboard and go to Security → WAF → Tools.
  2. Under IP Access Rules, add each Topscan address with the action Allow, applied to this website.
  3. If you use custom WAF rules or Under Attack mode, add a custom rule that skips the WAF, rate limiting and bot checks for requests whose source IP is in the Topscan list, and place it above the blocking rules.

AWS WAF

  1. In the AWS WAF console create an IP set with the Topscan addresses.
  2. In the web ACL attached to your load balancer, CloudFront distribution or API Gateway, add a rule that matches that IP set with the action Allow.
  3. Move the rule above any blocking or rate-based rules. Rules are evaluated in priority order.

Imperva, Akamai and other managed WAFs

Add the Topscan addresses to the WAF's allowlist (often called "IP exceptions", "trusted IPs" or "whitelist") so that security policies and bot management don't apply to them. Keep the exception scoped to the sites you monitor with Topscan.

Your own servers

  • nginx / Apache: if you restrict access by IP, allow the Topscan addresses before the deny rules.
  • iptables / nftables / cloud security groups: add inbound allow rules for the Topscan addresses on the ports you expose.
  • fail2ban: add the addresses to ignoreip so that scanning activity doesn't get them banned.
  • Rate limiting: exempt the addresses, or raise the limit for them. A scan sends many more requests than a normal visitor.

Check that it worked

Open the scan page and press Run scan again, or wait for the next scheduled scan. If the target is still unreachable, the same message appears. Recheck the host, and make sure the exception covers every layer in front of the target, including the CDN and any rate limiter. Once the scan goes through, the message disappears from the scan and the target page.

On the Free plan

On the Free plan the license stays with this target. If the address is wrong or the host is gone for good, contact support at support@topscan.me and we'll move the license to another target.

What's next