Probe locations & IP ranges
Where checks run from, and how to allowlist them.
WatchFor runs checks from multiple locations around the world. Checking from many vantage points is what lets it tell a real outage from a local network hiccup.
Why multiple locations
- Fewer false alarms — a failure is confirmed from several locations before an incident opens.
- Regional insight — see when a problem affects one region but not others.
- Honest latency — response times reflect real-world distance, not a single lucky data centre.
Allowlisting WatchFor
If your service sits behind a firewall or allowlist, you may need to permit WatchFor's probe addresses so checks aren't blocked. The full, current list — grouped by region, with IPv4, IPv6 and hostnames — lives at watchfor.io/ip-ranges.
For automated allowlisting, pull one of the machine-readable endpoints on a schedule instead of hard-coding addresses, so new locations are picked up automatically:
/ips.json— structured, with hostname and location per address/ipv4.txt— plain IPv4 list, one per line/ipv6.txt— plain IPv6 list, one per line
Every probe IP has forward-confirmed reverse DNS under *.probe.watchfor.io,
so you can verify a request genuinely came from us rather than someone spoofing
our User-Agent. The bot page explains how to identify and verify
WatchFor's requests.
Seeing failures only from WatchFor but your site is up? A firewall or rate-limiter blocking probe IPs is the usual cause — allowlist the published ranges.
Choosing IP version
Checks default to IPv4. Where your target supports it, you can switch a monitor to IPv6.