Security for defenders¶
Guidance for allowing SQUR traffic and understanding runtime behavior.
Egress IP allowlisting¶
Allow outbound SQUR traffic from these static IPs:
- 104.155.20.182
- 34.76.33.170
- 34.22.192.89
Out-of-band (OOB) interaction testing¶
Some vulnerability classes produce no visible response in the application — blind SSRF, blind XXE, blind command injection and similar. SQUR confirms these by injecting a unique hostname and waiting for your infrastructure to contact it.
These callbacks go to SQUR's dedicated OOB server:
| Domain | prod.oob.squr.ai — a unique subdomain per test, e.g. a1b2c3.prod.oob.squr.ai |
| IP | 130.211.69.252 |
| Protocols | DNS, HTTP, HTTPS, SMTP |
| Hosting | SQUR-operated in europe-west1 (Belgium), not a shared third-party OOB service |
Note the direction. This is outbound traffic from your systems to SQUR, triggered by your own application. It is the one case where SQUR-related traffic does not come from the egress IPs above, and it originates from whichever host resolved or fetched the payload.
What defenders should know¶
- Expect it in your logs. During a pentest you may see DNS lookups or requests to random subdomains of
prod.oob.squr.ai. That is SQUR's OOB channel — not an attacker, and not data exfiltration. Attribute it before escalating. - Blocking it is a valid choice, but it hides findings. If outbound DNS/HTTP from the target environment is restricted, blind vulnerability classes cannot be confirmed and will be reported as not found. That is a false negative, not a clean result. To have them covered, permit egress to
prod.oob.squr.ai/130.211.69.252for the duration of the pentest. - Interactions are encrypted per pentest. The OOB server runs in private mode: recorded interactions are encrypted to a key held only by the pentest that generated them.
User agent behavior¶
Do not rely on the user agent to identify SQUR traffic — use the egress IPs above. They are the dependable signal; the user agent is not.
A pentest drives a wide range of tooling, and each part sends its own user agent:
- Some requests identify SQUR explicitly, with a user agent containing
SQUR. - Standard security tooling (
curl,nmap,sqlmap,ffufand similar) sends that tool's own default, which names the tool rather than SQUR. - Browser-driven testing presents as an ordinary desktop browser. This is deliberate: an application that changes its behavior for a non-browser user agent would not be exercised the way a real attacker would encounter it.
The user agent also carries no reliable per-pentest identifier. To correlate traffic with a specific engagement, use the egress IPs together with the engagement's start and end times, or ask your SQUR contact.
This matters in two directions. If you are allowlisting or attributing our traffic, filter on the egress IPs. If you are excluding pentest traffic from analytics, bot detection or fraud scoring, filter on the egress IPs there too — a user-agent rule will let most of it through.
Network overview¶
- All testing actions respect your configured scope and permissions.
- Testing traffic originates from the egress IPs above. OOB callbacks are the exception and travel the other way — see Out-of-band (OOB) interaction testing.
- Rate limits and safety checks are applied to avoid disruption.
PII minimization¶
- Provide dedicated test accounts without personal data where possible.
- SQUR minimizes retention of PII in logs and findings.
- Use roles with least-privilege access appropriate for testing.