Infaris

Guard in your logs?

Then Guard by Infaris is checking this website for its owner or administrator. Guard monitors whether a site is online and measures how secure, fast, findable and accessible it is. This page explains what Guard does, where it comes from and how to allow it.

IP addresses

Guard itself only comes from these addresses. Scans only come from the first.

AddressRegionUsed for
45.137.199.143NLScans and monitoring
217.182.155.252FRMonitoring
161.35.48.135USMonitoring

What Guard does

  • Guard only checks sites that their owner or administrator added to Guard themselves.
  • Monitoring: one request to the site every minute, from the Netherlands, France and the United States.
  • Scans: on a schedule, or when the owner asks, a round of pages and well-known files such as robots.txt, sitemap.xml, llms.txt, security.txt and paths under /.well-known/. Some of these usually do not exist and show up as 404s in your logs. That is expected.
  • Guard does not sign in, fill in forms or run load tests. An application scan of a login page only runs when the owner sets one up.
  • For an independent second opinion, Guard also has the site tested by outside services such as SSL Labs and internet.nl. Those come from their own addresses, not from the ones below.

How Guard behaves

  • One scan at a time per site, with at most four requests at once.
  • A new site gets its first scans one after the other, spread over a few minutes.
  • If your site answers 429 (too many requests), Guard stops scanning until the time in Retry-After has passed.
  • If Guard can no longer get in while the site works for others, Guard pauses every scan and asks the owner to allow the addresses below.

User-Agent

The scans that ask for specific files name themselves and link to this page. Monitoring and browser scans use a regular browser so they see the site as a visitor does: recognise those by the IP addresses.

  • Mozilla/5.0 (compatible; Guard-AgentCheck/1.0; +https://infaris.com/bots)
  • Mozilla/5.0 (compatible; Guard-WordPressCheck/1.0; +https://infaris.com/bots)
  • Mozilla/5.0 (compatible; Guard-SEOCheck/2.0; +https://infaris.com/bots)

Allowing Guard

  • Put the IP addresses above on the allow list of your firewall or security plugin, for example Wordfence, Imunify360, CSF or Cloudflare's WAF.
  • If an address is already on a block list, remove it. Guard notices within a few minutes that the site is reachable again and resumes scanning on its own.

Questions, or rather no Guard?

Please contact the site's owner first: they switched Guard on. To reach us directly, or if you think Guard misbehaves, mail security@infaris.com.