LevelBlue Knowledge Base » Knowledgebase » Vulnerability Management

Trustwave External Vulnerability Scans Policy for "Host(s) Not Detected"

Charles Creegan — Mon, 20 Oct 2025 00:25:01 GMT

This article applies to:

External Vulnerability Scanning

Information:

Please see the updated SecureTrust External Vulnerability Scans Policy for "Host(s) Not Detected".

Scan Attestation

Charles — Thu, 06 Dec 2018 16:04:54 GMT

This article applies to:

External Vulnerability Scanning – Scan Target Attestation

Purpose:

This process is designed to ensure security and compliance by providing a clear way to review and confirm your scanning environment and setup.

Information:

Effective February 1, 2019, passing PCI External Vulnerability Scan results will not apply to the account status unless there is an active attestation on record. Scan target(s) – IP Addresses and/or website URLs – will require verification at least once every 90 days, or any time changes are made to your current scan target(s).

An attestation expiration and acknowledgment link will be found under the "PCI Network Vulnerability Scan" space on your PCI Manager dashboard. This offers quick access to renew your attestation from the Home page, if there have been no changes to the current scan setup.

You will also be prompted to confirm your current scan target(s) any time changes are made to the current scan setup, which will automatically reset the 90-day attestation window.

What this means for me:

Will my PCI Account Status be affected?

Yes. As of February 1, 2019, if your credit card environment requires External Vulnerability Scanning as part of PCI Compliance, the outcome of your scans will not count towards compliance without confirmation of the scan target(s). Once they’ve been confirmed using the "Acknowledge my scan setup" link, your account status will update to reflect any current, passing scans.

Will scans continue to run if I haven't attested to the target(s)?

Yes. Your current scan schedule will not be affected by this requirement. The results of any passing scans will not, however, be applied to the account’s status until the scan target(s) have been verified. If this happens, simply log into your account, confirm the scan target(s), and the results of any current, passing scans will be automatically applied towards the account status.

Will I still be able to see the scan results even if I forgot to attest to my scan target(s) on time?

Yes. You will still have access to the scan report online and by downloading a PDF copy, including remediation information for current vulnerabilities.

PDF reports of your scans will reflect the attestation status at the time the report is generated.

Reports on unconfirmed target(s) will include the following statement:
PDF reports of scans run on verified target(s) will include the following statement:

Will I be assessed non-compliance fees/penalties if I haven't attested yet?

Most likely. Your account status will certainly be affected if you haven’t yet attested to the scan target(s) prior to February 1, 2019. PCI DSS requirements, however, are typically enforced by different groups, depending on your card processing environment. If you would like to confirm any potential penalties for lack of PCI Compliance you are highly encouraged to contact your merchant bank, or other group requiring you to demonstrate compliance. Trustwave does not enforce PCI Compliance.

Video Resources:

PCI external vulnerability scanner source IPs

Charles Creegan — Fri, 10 Aug 2018 14:32:16 GMT

This article applies to:

Trustwave external vulnerability scans

Purpose:

This page documents the IP addresses used to originate Trustwave external vulnerability scans.

This information applies worldwide to all applicable customers.
Services that utilize these scanners include PCI compliance validation through PCI Manager* and Trustwave Vulnerability Manager.

Information:

Most common Trustwave external vulnerability scans (EVS) originate from the following range of IP addresses:

64.37.231.0/24 (64.37.231.1 through 64.37.231.254)

Please note that for certain compliance requirements, such as PCI DSS, interference with a vulnerability scanner may result in an inconclusive scan and thus a Fail score. Active protection systems like intrusion prevention systems (such as IDS, IPS or WAFs) could interfere with vulnerability scanners. Additionally, it is required that all stated scan target hosts are detectable by Trustwave to ensure a complete scan. As such, Trustwave scanner IP(s) may need to be whitelisted for the duration of the scan. Learn more about host detection and whitelisting.

Less common Trustwave external vulnerability scans (EVS) originate from the following IP addresses:

111.108.90.138 through 111.108.90.139 - Tokyo, Japan
124.211.46.74 through 124.211.46.75 - Osaka, Japan
204.225.91.58 through 204.225.91.59 - Toronto, Canada
209.90.139.122 through 209.90.139.123 - London, Canada
220.101.105.8 through 220.101.105.9 - Sydney, Australia
220.101.107.8 through 220.101.107.9 - Melbourne, Australia

Trustwave reserves the right to make changes at any time without notification. This page will be updated with changes as required.

* Note: The name of the PCI compliance tool for certain bank-sponsored programs may be different.