rezmoss/cloud-provider-ip-addresses

Daily-updated IP ranges for 60+ providers (AWS, Azure, GCP, Cloudflare, GitHub, Fastly, Linode + GoogleBot, BingBot, GPTBot) in 13+ formats: TXT, JSON, CSV, SQL, Nginx, Apache, iptables, nftables, UFW, HAProxy, Caddy + merged CIDRs

Shell

199

761 commits

updated Oct 20, 2026

See the code

See what people are saying

SourceMessageScoreDate

From 22 to 67 providers: an update to my open-source cloud IP range dataset (r/selfhosted)

I shared an early version of this project here back in February, when it covered 22 providers. A few people asked what made it different from the other IP range lists, and there were good questions about how safely the output could be used I've continued working on it, and the dataset now covers 67…

4

Oct 13, 2026

README

Cloud Provider IP Addresses

The most comprehensive, daily-updated collection of IP ranges from cloud providers, CDNs, and web crawlers — in 13+ output formats.

GitHub stars GitHub license Last Updated Providers Formats Update

67 providers | 13+ output formats | Merged/optimized CIDRs | Firewall-ready configs | Unified cross-provider dataset | Daily changelog | IP lookup tool | Go & JS client libraries

Live Stats

Last updated: 2026-10-13 | Providers: 67 | Total CIDRs: 451,779 | IPv4 addresses: 459,450,004 | IPv4 space: 10.70%

ProviderIPv4 CIDRsIPv6 CIDRsTotal CIDRsIPv4 AddressesServicesRegions
akamai7,7983,02610,82421,643,472181
alibaba2,1542472,40131,628,80031
amazonbot3,13103,1313,13130
apple_private_relay41,734243,357285,091105,64701284
applebot240244,75210
atlassian1106017082,1141218
aws10,6306,94317,573188,289,4162743
azure69,39226,68296,074109,442,075332177
backblaze2659859,47221
baidu17714191665,60021
bingbot280284,73610
bunny1434484,09611
cachefly160164,09600
circleci520524,03131
claudebot380381,13610
cloudflare157221,524,73600
commoncrawl4152810
contabo74414758757,76031
datadog1541016438,362110
digitalocean1,0861481,2343,134,848013
discord200202020
duckduckbot486048648610
fastly21324353,28000
gabia144014452,60811
gcore9838441,82798300
github5,7041,5447,24828,377,223110
gocache2502560000
googlebot1701473175,08810
googlecloud1,032951,12719,302,528148
googleservices297973944,908,92811
gptbot291029141,76030
hetzner68776943,590,40031
hostway174017474,75211
huawei588936811,169,15261
ibmcloud340734133,756,03211
imperva11112261,12000
internetarchive8198,19221
leaseweb1,6833722,0552,404,864181
linode5,409965,5051,392,640038
meta346418764584,44831
microsoft3653459932,514,95700
mullvad5665561,122566250
nhncloud3770377137,72831
oracle1,10701,1074,349,962356
ovhcloud733447774,685,56811
perplexitybot120123220
pingdom1495720614900
play2go182018248,12815
quiccloud152015215200
rackspace312143262,298,880151
salesforce54559881,66451
scaleway4221632,580,73621
statuscake183018318300
stormwall157223,84011
sucuri1613295,63211
teamcity110111121
telegram951411,00800
tencent3,365723,43714,991,61621
tor1,20901,2091,20911
upcloud9321114105,47221
uptimerobot10310320610314
vultr443524951,044,992036
wasabi200205,12011
yandex12432156450,56061
zoho1711919078,59291
zoom55257539,92430
zscaler937841,0211,079,80841

Total IPv4 Coverage Over Time

Total routable IPv4 addresses tracked daily

Total routable IPv4 addresses across all tracked providers, updated daily since tracking began. Underlying data: stats_history.json.


Table of Contents


Why This Repo?

There are other cloud IP range repos out there. Here's what makes this one different:

FeatureThis RepoOthers
Cloud providersAWS, Azure, GCP, Cloudflare, DigitalOcean, Oracle, Fastly, GitHub, Linode, Vultr, Contabo, Play2Go, UpCloud, NHN Cloud, Hostway, Gabia + Apple Private Relay, TelegramVaries
CDN / storage / WAFG-Core Labs, CacheFly, GoCache, Quic.cloud, Bunny CDN, Wasabi, Backblaze, Imperva, Sucuri, StormWallRare
Bot/crawler IPsGoogleBot, BingBot, GPTBot/ChatGPT, ClaudeBot, AppleBot, PerplexityBot, DuckDuckBot, Amazonbot, Common CrawlRare
SaaS / CollaborationMicrosoft 365, Zoom, Atlassian (Jira, Confluence, Bitbucket, Trello, ...)Very rare
Output formats13+ (TXT, JSON, CSV, SQL, Nginx, Apache, iptables, nftables, UFW, HAProxy, Caddy, ipset, merged CIDRs)Usually 1-3
Merged/optimized CIDRsPer-provider and combinedRare
Unified cross-provider fileall_providers.json / .csv with normalized schemaRare
Service/region breakdownPer-service and per-region files for AWS, Azure, GCP, Oracle, GitHub, GPTBot, Apple Private Relay, Vultr, PerplexityBot, Amazonbot, Zoom, AtlassianSome
IP lookup toollookup.py — "which cloud owns this IP?"Separate projects
ChangelogDaily diff tracking (CIDRs added/removed)Rare
StatisticsSTATS.md + summary.json with IPv4 space coverageRare
Update frequencyDaily at 02:00 UTCVaries
Firewall-ready configsNginx, Apache, iptables, nftables, UFW, HAProxy, CaddyUsually 0-1

Quick Start

Grab what you need with a single command:

# All AWS IPs (plain text)
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws_ips.txt

# Cloudflare IPv4 only
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/cloudflare_ips_v4.txt

# All providers merged into one optimized IPv4 list
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers_merged_v4.txt

# Block GPTBot with iptables
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/gptbot/iptables_gptbot_deny.sh | sudo bash

# AWS Nginx allow config — drop into your server block
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/nginx_aws_allow.conf -o /etc/nginx/conf.d/aws_allow.conf

# Unified dataset (all providers, normalized JSON)
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers.json

# Look up an IP
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/lookup.py -o lookup.py
python3 lookup.py --data-dir . 13.32.0.1

Download Mirrors (jsDelivr CDN)

Every file in this repo is also served from the free, globally-cached jsDelivr CDN. Use it for faster downloads and to avoid GitHub's raw.githubusercontent.com rate limits — handy when many servers pull on a schedule.

Swap the host and path prefix:

raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/<path>
        ↓
cdn.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/<path>
# Same files, via CDN
curl -sL https://cdn.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/aws/aws_ips.txt
curl -sL https://cdn.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/all_providers/all_providers_merged_v4.txt

# Fastly-backed fallback host (same paths)
curl -sL https://fastly.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/cloudflare/cloudflare_ips_v4.txt
  • @main — always the latest daily data. Our update workflow purges the jsDelivr cache for key files on every push, so @main refreshes within minutes instead of waiting out the CDN's default cache window.
  • @vYYYY.MM.DD — pin a specific dated release for reproducible, immutable downloads (e.g. [email protected]/aws/aws_ips.txt).

Note: GitHub's raw.githubusercontent.com URLs continue to work unchanged. jsDelivr is an optional, faster mirror.

Versioned Release Bundles

Each daily run also publishes a GitHub Release (tagged vYYYY.MM.DD) with the entire dataset bundled as a single download, plus SHA-256 checksums for integrity verification:

# Latest full dataset — always resolves to the most recent release
curl -sLO https://github.com/rezmoss/cloud-provider-ip-addresses/releases/latest/download/all_providers.zip
curl -sLO https://github.com/rezmoss/cloud-provider-ip-addresses/releases/latest/download/SHA256SUMS

# Verify the bundle, then extract
sha256sum -c SHA256SUMS --ignore-missing
unzip all_providers.zip -d cloud-ips

Pin a specific date for reproducible, immutable downloads:

curl -sLO https://github.com/rezmoss/cloud-provider-ip-addresses/releases/download/v2026.06.17/all_providers.zip

SHA256SUMS lists checksums for every file in the dataset, so after extracting you can re-run sha256sum -c SHA256SUMS inside the extracted directory to verify all files.


Supported Providers

Cloud Providers

ProviderIPsServicesRegionsSource
AWSIPv4 + IPv6Per-service (EC2, S3, CloudFront, ...)Per-regionAWS public IP ranges
Microsoft AzureIPv4 + IPv6Per-service (AzureCloud, AppService, ...)Per-regionAzure Service Tags
Google CloudIPv4 + IPv6Per-servicePer-scopeGCP public IP ranges
Google ServicesIPv4 + IPv6——Google-owned ranges outside GCP customer space (goog.json minus cloud.json)
CloudflareIPv4 + IPv6——Cloudflare published IP list
DigitalOceanIPv4 + IPv6—Per-regionDigitalOcean public geofeed
Oracle CloudIPv4 + IPv6Per-service (tags)Per-regionOracle Cloud public IP ranges

CDN / Hosting

ProviderIPsServicesSource
FastlyIPv4 + IPv6—Fastly public IP list
GitHubIPv4 + IPv6Per-service (actions, pages, copilot, hooks, web, api, ...)GitHub Meta API
Linode (Akamai)IPv4 + IPv6—Linode public geofeed
Apple (iCloud Private Relay)IPv4 + IPv6—Apple published egress ranges
VultrIPv4 + IPv6Per-regionVultr public geofeed
Play2GoIPv4Per-countryPlay2Go official geofeed
TelegramIPv4 + IPv6—Telegram official CIDR list
ImpervaIPv4 + IPv6—Imperva cloud WAF / CDN IP feed
G-Core LabsIPv4 + IPv6—G-Core CDN public IP list
CacheFlyIPv4 + IPv6—CacheFly edge IP list
GoCacheIPv4 + IPv6—GoCache CDN IP list
Quic.cloudIPv4 + IPv6—QUIC.cloud CDN IP list

SaaS / Collaboration

ProviderIPsServicesSource
ZoomIPv4 + IPv6Per-service (zoom, zoom-phone, zoom-contact-center, zoom-cdn)Zoom published IP ranges
AtlassianIPv4 + IPv6Per-product (Jira, Confluence, Bitbucket, Trello, ...)Atlassian published IP ranges
Microsoft 365IPv4 + IPv6—Microsoft 365 worldwide endpoints API
DiscordIPv4Per-service (api, media)Discord published egress IP list (incl. Discordbot link previews)

CI/CD & Monitoring

ProviderIPsServices / RegionsSource
CircleCIIPv4Per-service (incl. macOS fleet)CircleCI published runner egress ranges
TeamCity CloudIPv4Per-service + per-regionJetBrains TeamCity Cloud build-agent ranges
DatadogIPv4 + IPv6Per-service (synthetics, webhooks, agent, ...)Datadog published IP ranges feed
UptimeRobotIPv4 + IPv6Per-service + per-regionUptimeRobot monitoring probe API
StatusCakeIPv4—StatusCake monitoring probe locations
PingdomIPv4 + IPv6—Pingdom monitoring probe IP list

Bots / Crawlers

BotIPsServicesSource
GoogleBotIPv4 + IPv6googlebotGoogle published crawler ranges
BingBotIPv4 + IPv6bingbotMicrosoft published crawler ranges
GPTBot / ChatGPT / SearchBotIPv4Per-service (gptbot, chatgpt-user, searchbot)OpenAI published bot ranges
ClaudeBot / Claude-User / Claude-SearchBotIPv4claudebotAnthropic published crawler ranges
AppleBotIPv4applebotApple published crawler ranges
PerplexityBotIPv4 + IPv6Per-service (perplexitybot, perplexity-user)Perplexity published bot ranges
DuckDuckBotIPv4 + IPv6duckduckbotDuckDuckGo published crawler ranges
AmazonbotIPv4 + IPv6Per-service (amazonbot, amzn-searchbot, amzn-user)Amazon published bot ranges
Common Crawl (CCBot)IPv4 + IPv6ccbotCommon Crawl published bot ranges

VPN / Anonymizer Networks

ProviderIPsServicesSource
Tor Exit NodesIPv4tor-exitOfficial Tor Project bulk exit list
Mullvad VPNIPv4 + IPv6Per-type (wireguard, bridge) + per-countryOfficial Mullvad relay API

BGP / ASN-Derived Networks

These entities publish no official IP range feed. Their ranges are derived from live BGP announcements of their officially registered ASNs, observed via public BGP data sources. They cover all address space the entity originates (not only cloud/customer ranges) and may miss space routed through partner networks. The table below lists the exact ASNs used.

ProviderIPsSource
AkamaiIPv4 + IPv6BGP announcements via public BGP data
Alibaba (Alibaba Cloud / Alibaba Group)IPv4 + IPv6BGP announcements via public BGP data
BackblazeIPv4 + IPv6BGP announcements via public BGP data
BaiduIPv4 + IPv6BGP announcements via public BGP data
Bunny CDNIPv4 + IPv6BGP announcements via public BGP data
ContaboIPv4 + IPv6BGP announcements via public BGP data
GabiaIPv4 + IPv6BGP announcements via public BGP data
HetznerIPv4 + IPv6BGP announcements via public BGP data
HostwayIPv4 + IPv6BGP announcements via public BGP data
Huawei CloudIPv4 + IPv6BGP announcements via public BGP data
IBM Cloud (SoftLayer)IPv4 + IPv6BGP announcements via public BGP data
Internet ArchiveIPv4 + IPv6BGP announcements via public BGP data
LeasewebIPv4 + IPv6BGP announcements via public BGP data
Meta (Facebook / Instagram / WhatsApp)IPv4 + IPv6BGP announcements via public BGP data
NHN CloudIPv4 + IPv6BGP announcements via public BGP data
OVHcloudIPv4 + IPv6BGP announcements via public BGP data
RackspaceIPv4 + IPv6BGP announcements via public BGP data
SalesforceIPv4 + IPv6BGP announcements via public BGP data
ScalewayIPv4 + IPv6BGP announcements via public BGP data
StormWallIPv4 + IPv6BGP announcements via public BGP data
SucuriIPv4 + IPv6BGP announcements via public BGP data
Tencent (Tencent Cloud / Tencent Group)IPv4 + IPv6BGP announcements via public BGP data
UpCloudIPv4 + IPv6BGP announcements via public BGP data
WasabiIPv4 + IPv6BGP announcements via public BGP data
YandexIPv4 + IPv6BGP announcements via public BGP data
ZohoIPv4 + IPv6BGP announcements via public BGP data
ZscalerIPv4 + IPv6BGP announcements via public BGP data

Per-Provider Pages

Each provider has its own page with quick-use snippets, sample CIDRs, and links to every output format.

ProviderPage
Akamaiakamai/
Alibaba (Alibaba Cloud / Alibaba Group)alibaba/
Amazonbotamazonbot/
Apple iCloud Private Relayapple_private_relay/
Applebotapplebot/
Atlassianatlassian/
Amazon Web Servicesaws/
Microsoft Azureazure/
Backblazebackblaze/
Baidubaidu/
Bingbotbingbot/
Bunny CDNbunny/
CacheFlycachefly/
CircleCIcircleci/
ClaudeBotclaudebot/
Cloudflarecloudflare/
Common Crawl (CCBot)commoncrawl/
Contabocontabo/
Datadogdatadog/
DigitalOceandigitalocean/
Discorddiscord/
DuckDuckBotduckduckbot/
Fastlyfastly/
Gabiagabia/
G-Core Labsgcore/
GitHubgithub/
GoCachegocache/
Googlebotgooglebot/
Google Cloud Platformgooglecloud/
Google Servicesgoogleservices/
OpenAI GPTBot / ChatGPT-User / SearchBotgptbot/
Hetznerhetzner/
Hostwayhostway/
Huawei Cloudhuawei/
IBM Cloud (SoftLayer)ibmcloud/
Impervaimperva/
Internet Archiveinternetarchive/
Leasewebleaseweb/
Linode (Akamai)linode/
Meta (Facebook / Instagram / WhatsApp)meta/
Microsoft 365microsoft365/
Mullvad VPNmullvad/
NHN Cloudnhncloud/
Oracle Cloud Infrastructureoracle/
OVHcloudovhcloud/
PerplexityBotperplexitybot/
Pingdompingdom/
Play2Goplay2go/
Quic.cloudquiccloud/
Rackspacerackspace/
Salesforcesalesforce/
Scalewayscaleway/
StatusCakestatuscake/
StormWallstormwall/
Sucurisucuri/
TeamCity Cloudteamcity/
Telegramtelegram/
Tencent (Tencent Cloud / Tencent Group)tencent/
Tor Exit Nodestor/
UpCloudupcloud/
UptimeRobotuptimerobot/
Vultrvultr/
Wasabiwasabi/
Yandexyandex/
Zohozoho/
Zoomzoom/
Zscalerzscaler/

Output Formats

Every provider gets all of these formats:

FormatFilesDescription
TXT{provider}_ips.txt, _v4.txt, _v6.txtOne CIDR per line
JSON{provider}_ips.jsonStructured with ip_address, ip_type, service, region
CSV{provider}_ips.csvTabular format for spreadsheets/databases
SQL{provider}_ips.sqlCREATE TABLE + INSERT statements
Nginxnginx_{provider}_allow.conf, _deny.confallow/deny rules with deny all/allow all
Apacheapache_{provider}_allow.conf, _deny.confRequire ip / Deny from directives
iptablesiptables_{provider}_allow.sh, _deny.shShell scripts with iptables/ip6tables rules
nftablesnftables_{provider}_allow.conf, _deny.confnftables table/chain definitions
UFWufw_{provider}_allow.sh, _deny.shufw allow/deny from commands
HAProxyhaproxy_{provider}_allow.confACL-compatible IP list
Caddycaddy_{provider}_allow.confremote_ip matcher block
ipset{provider}.netsetipset restore-loadable hash:net sets (IPv4 + IPv6)
Merged CIDRs{provider}_ips_merged_v4.txt, _merged_v6.txtOptimized/collapsed CIDR lists
Metadata{provider}_meta.jsonVersion, freshness dates, and subnet/address counts

For providers with service/region data (AWS, Azure, GCP, Oracle, GitHub, GPTBot, Apple Private Relay, Vultr, PerplexityBot, Amazonbot, Zoom, Atlassian), all formats are also generated per-service and per-region. (ipset and metadata are generated at the provider level.)

ipset (large lists)

For providers with thousands of CIDRs (Azure, AWS, Apple Private Relay, ...), one iptables/ufw rule per range is impractical. The ipset format loads the whole set into a kernel hash table that a single firewall rule can match in O(1):

# Load the set (defines {provider}_v4 and {provider}_v6)
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws.netset | sudo ipset restore -!

# Match it from one iptables rule
sudo iptables -A INPUT -m set --match-set aws_v4 src -j ACCEPT
sudo ip6tables -A INPUT -m set --match-set aws_v6 src -j ACCEPT

Note: ipset is the iptables-era tool. On nftables-based systems, use the provided nftables_{provider}_allow.conf (nftables has native sets).

Metadata & change detection

Each provider ships a {provider}_meta.json with a monotonic version that increments only when the IP set actually changes, plus generated_date, last_changed_date, per-family subnet/address counts, and a content_sha256. Poll version (or the .netset header) to decide whether to reload your firewall — no need to diff the full list:

curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/cloudflare_meta.json
# { "provider": "cloudflare", "version": 1, "generated_date": "...", "last_changed_date": "...",
#   "ipv4": { "cidrs": 15, "merged_cidrs": 15, "addresses": 1524736 }, ... }

Merged / Optimized CIDRs

Adjacent and overlapping CIDR blocks are collapsed into the smallest possible list using ipaddress.collapse_addresses(). This is ideal for firewall rules where you need the most compact representation.

# AWS optimized IPv4 list
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws_ips_merged_v4.txt

# All providers combined into one merged list
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers_merged_v4.txt

Each provider directory contains:

  • {provider}_ips_merged_v4.txt — optimized IPv4 CIDRs
  • {provider}_ips_merged_v6.txt — optimized IPv6 CIDRs
  • {provider}_ips_merged.txt — both combined

Unified Cross-Provider Data

A single normalized dataset across all providers, available in all_providers/:

FileDescription
all_providers.jsonAll CIDRs with cidr, ip_version, provider, service, region, last_updated
all_providers.csvSame data in CSV
all_providers_ips.txtAll CIDRs, one per line
all_providers_merged_v4.txtAll providers merged into one optimized IPv4 list
all_providers_merged_v6.txtAll providers merged into one optimized IPv6 list
# Query all providers with jq — find all Azure CIDRs in eastus
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers.json \
  | jq '[.[] | select(.provider=="azure" and .region=="eastus")]'

IP Lookup Tool

Find which cloud provider owns any IP address:

# Download the tool and data
git clone https://github.com/rezmoss/cloud-provider-ip-addresses.git
cd cloud-provider-ip-addresses

# Single IP
python3 lookup.py 13.32.0.1
# Output: 13.32.0.1 — AWS (AMAZON, us-east-1) [13.32.0.0/15]

# Multiple IPs
python3 lookup.py 13.32.0.1 104.16.0.1 168.63.129.16

# Batch mode from file
python3 lookup.py --file suspicious_ips.txt

# JSON output
python3 lookup.py --json 8.8.8.8

Fast Lookup (Radix Tree)

For large-scale lookups, radix_lookup.py uses a radix tree pysubnettree (github.com/zeek/pysubnettree) for O(1) lookups — 2M+ IPs/sec for IPv4, 1.6M+ IPs/sec for IPv6. Same interface and output as lookup.py.

pip3 install -r requirements.txt
python3 radix_lookup.py 13.32.0.1
python3 radix_lookup.py --file suspicious_ips.txt
python3 radix_lookup.py --json 8.8.8.8

ip-watch — Apply & Auto-Sync to Your Servers

The files in this repo tell you what the IP ranges are. ip-watch is the official companion that applies them — it keeps these ranges enforced on your webserver and firewall on a daily schedule, with validation and safe rollback, so you never hand-edit a config or babysit a cron job again.

Keep cloud-provider IP ranges applied to your webserver and firewall, on a daily schedule with safe rollback.

A single static Go binary (~7 MB, zero runtime dependencies) that consumes this dataset directly.

What it does for you:

  • 7 engines — nginx, Caddy, Apache, HAProxy (config layer) and nftables, iptables, ufw (firewall layer)
  • Allow or deny modes — whitelist trusted clouds/CDNs, or blocklist AI crawlers (GPTBot, CCBot, ...) and Tor exit nodes
  • Merge across providers — combine multiple providers into a single target (e.g. Cloudflare + Fastly allowlist)
  • Pre-validation + atomic rollback — every change is checked with the engine's native validator (nginx -t, caddy validate, ...) and reverted automatically if validation or reload fails
  • Anti-lockout design — SSH protection and escape hatches so a bad rule can't lock you out of your own box
  • Daily auto-refresh with change detection, plus a Web UI + CLI, /healthz, Prometheus metrics, and Slack/Mattermost webhooks
  • Docker support and signed, multi-arch release artifacts
# Install (one-liner)
curl -fsSL https://raw.githubusercontent.com/rezmoss/ip-watch/main/install.sh | sudo sh
# also available via apt, dnf, zypper, Homebrew, Nix, and ghcr.io/rezmoss/ip-watch

# Add Cloudflare's ranges to an nginx vhost and enforce immediately
sudo ip-watch add -id cf -provider cloudflare -engine nginx \
    -selector example.com -apply

ip-watch providers          # list available providers with CIDR counts
ip-watch apply --dry        # preview changes without touching anything
ip-watch status             # per-target state
ip-watch history -n 50      # recent operations

Full docs, configuration, and engine guides: ip-watch README.


Client Libraries (Go & JavaScript)

Prefer to consume this data from code instead of curling raw files? Two official client libraries ship with auto-updating, offline-capable IP detection for AWS, GCP, Azure, Cloudflare, DigitalOcean, and Oracle Cloud. Both pull from a compiled binary index (cloudip-db) derived from this repository's daily output, with SHA-256-verified updates and an embedded fallback for air-gapped environments.

Go — go-cloudip

Sub-microsecond lookups via Patricia trie. Thread-safe, lock-free reads.

go get github.com/rezmoss/go-cloudip
import "github.com/rezmoss/go-cloudip"

cloudip.IsAWS("52.94.76.1")           // true
cloudip.GetProvider("34.64.0.1")      // "gcp"
cloudip.IsCloudProvider("104.16.0.1") // true

result := cloudip.Lookup("52.94.76.1")
// result.Provider, result.Region, result.Service, result.CIDR

Full API, custom detectors, offline mode, and auto-update options: go-cloudip README.

JavaScript / TypeScript — js-cloudip

Node.js and browser (CORS-friendly). TypeScript types included. Ships a CLI and a forward-lookup mode ("give me every Cloudflare CIDR").

npm install js-cloudip
import { lookup, getProvider, isAws, getIPs } from 'js-cloudip';

await isAws('52.94.76.1');         // true
await getProvider('34.64.0.1');    // "gcp"

const r = await lookup('52.94.76.1');
// { found: true, provider: 'aws', region: 'us-east-1', service: 'EC2', cidr: '52.94.0.0/16', ip_type: 'ipv4' }

const cf = await getIPs('cloudflare'); // all Cloudflare CIDRs

Use the /embedded subpath for offline / air-gapped use, or the cloudip CLI:

npx cloudip lookup 52.94.76.1
npx cloudip get cloudflare

Full API, browser usage, and configuration: js-cloudip README.

Note: the libraries currently cover the six major cloud providers above. The full 37-provider dataset (CDNs, SaaS, bots/crawlers, VPNs, BGP-derived networks) remains available as raw files in this repo.


Changelog & Stats

Daily Changelog

IP range changes are tracked daily in CHANGELOG.md and machine-readable diffs in changes/:

  • CHANGELOG.md — human-readable summary of CIDRs added/removed per provider
  • changes/{date}.json — machine-readable daily diff

Statistics

  • STATS.md — per-provider IPv4/IPv6 CIDR counts, total addresses, services, regions
  • summary.json — machine-readable version with IPv4 space coverage percentage
# Check today's changes
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/CHANGELOG.md

# Get stats as JSON
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/summary.json

Folder Structure

cloud-provider-ip-addresses/
├── aws/
│   ├── aws_ips.txt / _v4.txt / _v6.txt
│   ├── aws_ips.json / .csv / .sql
│   ├── aws_ips_merged_v4.txt / _merged_v6.txt / _merged.txt
│   ├── nginx_aws_allow.conf / _deny.conf
│   ├── apache_aws_allow.conf / _deny.conf
│   ├── iptables_aws_allow.sh / _deny.sh
│   ├── nftables_aws_allow.conf / _deny.conf
│   ├── ufw_aws_allow.sh / _deny.sh
│   ├── haproxy_aws_allow.conf
│   ├── caddy_aws_allow.conf
│   ├── aws.netset                    (ipset restore-loadable)
│   ├── aws_meta.json                 (version + freshness + counts)
│   ├── services/
│   │   └── ec2/ s3/ cloudfront/ ...  (all formats per service)
│   └── regions/
│       └── us_east_1/ eu_west_1/ ...  (all formats per region)
├── azure/                (same structure)
├── googlecloud/          (same structure)
├── googleservices/       (all formats, no services/regions)
├── oracle/               (same structure)
├── cloudflare/           (all formats, no services/regions)
├── digitalocean/         (all formats, no services/regions)
├── fastly/               (all formats)
├── github/               (all formats + services)
├── linode/               (all formats)
├── googlebot/            (all formats)
├── bingbot/              (all formats)
├── gptbot/               (all formats + services)
├── claudebot/            (all formats)
├── applebot/             (all formats)
├── apple_private_relay/  (all formats + regions)
├── telegram/             (all formats)
├── vultr/                (all formats + regions)
├── perplexitybot/        (all formats + services)
├── duckduckbot/          (all formats)
├── amazonbot/            (all formats + services)
├── commoncrawl/          (all formats)
├── zoom/                 (all formats + services)
├── atlassian/            (all formats + services + regions)
├── circleci/             (all formats + services)
├── teamcity/             (all formats + services + regions)
├── datadog/              (all formats + services)
├── uptimerobot/          (all formats + services + regions)
├── statuscake/           (all formats)
├── pingdom/              (all formats)
├── meta/                 (all formats + services; BGP/ASN-derived)
├── alibaba/              (all formats + services; BGP/ASN-derived)
├── tencent/              (all formats + services; BGP/ASN-derived)
├── ibmcloud/             (all formats + services; BGP/ASN-derived)
├── hetzner/              (all formats + services; BGP/ASN-derived)
├── ovhcloud/             (all formats + services; BGP/ASN-derived)
├── scaleway/             (all formats + services; BGP/ASN-derived)
├── akamai/               (all formats + services; BGP/ASN-derived)
├── leaseweb/             (all formats + services; BGP/ASN-derived)
├── rackspace/            (all formats + services; BGP/ASN-derived)
├── salesforce/           (all formats + services; BGP/ASN-derived)
├── zscaler/              (all formats + services; BGP/ASN-derived)
├── yandex/               (all formats + services; BGP/ASN-derived)
├── huawei/               (all formats + services; BGP/ASN-derived)
├── tor/                  (all formats; official Tor Project exit list)
├── mullvad/              (all formats + services + regions)
├── microsoft365/         (all formats; official Microsoft 365 endpoints feed)
├── imperva/              (all formats; official Imperva WAF/CDN feed)
├── gcore/                (all formats; official G-Core Labs CDN feed)
├── cachefly/             (all formats; official CacheFly edge list)
├── gocache/              (all formats; official GoCache CDN feed)
├── quiccloud/            (all formats; official QUIC.cloud CDN list)
├── zoho/                 (all formats + services; BGP/ASN-derived)
├── wasabi/               (all formats + services; BGP/ASN-derived)
├── upcloud/              (all formats + services; BGP/ASN-derived)
├── sucuri/               (all formats + services; BGP/ASN-derived)
├── stormwall/            (all formats + services; BGP/ASN-derived)
├── baidu/                (all formats + services; BGP/ASN-derived)
├── backblaze/            (all formats + services; BGP/ASN-derived)
├── nhncloud/             (all formats + services; BGP/ASN-derived)
├── hostway/              (all formats + services; BGP/ASN-derived)
├── gabia/                (all formats + services; BGP/ASN-derived)
├── bunny/                (all formats + services; BGP/ASN-derived)
├── internetarchive/      (all formats + services; BGP/ASN-derived)
├── discord/              (all formats + services; official Discord egress list)
├── contabo/              (all formats + services; BGP/ASN-derived)
├── play2go/              (all formats + regions; official Play2Go geofeed)
├── all_providers/
│   ├── all_providers.json / .csv
│   ├── all_providers_ips.txt
│   └── all_providers_merged_v4.txt / _merged_v6.txt
├── changes/
│   └── {date}.json       (daily diffs)
├── CHANGELOG.md
├── STATS.md
├── summary.json
├── lookup.py
├── LICENSE
└── README.md

Usage Examples

curl One-Liners

# Get all AWS IPs
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws_ips.txt

# Get GitHub Actions IPs only
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/github/services/actions/github_actions_ips.txt

# Get GPTBot IPs to block AI crawlers
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/gptbot/gptbot_ips.txt

# Get optimized Cloudflare list for firewall
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/cloudflare_ips_merged_v4.txt

Nginx

# Download and include
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/nginx_aws_allow.conf \
  -o /etc/nginx/conf.d/aws_allow.conf
server {
    # Allow only AWS IPs
    include /etc/nginx/conf.d/aws_allow.conf;
}
sudo nginx -s reload

Apache

curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/apache_aws_allow.conf \
  -o /etc/apache2/conf-available/aws_allow.conf
<Directory /var/www/html>
    AllowOverride None
    Require all denied
    Include /etc/apache2/conf-available/aws_allow.conf
</Directory>
sudo systemctl reload apache2

iptables

# Allow all Azure IPs
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/azure/iptables_azure_allow.sh | sudo bash

# Block GPTBot
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/gptbot/iptables_gptbot_deny.sh | sudo bash

UFW

# Allow GitHub Actions IPs
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/github/services/actions/ufw_github_actions_allow.sh | sudo bash

nftables

# Download nftables config
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/nftables_cloudflare_allow.conf \
  -o /etc/nftables.d/cloudflare_allow.conf

HAProxy

# Download ACL file
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/haproxy_aws_allow.conf \
  -o /etc/haproxy/aws_ips.acl
frontend http
    acl is_aws src -f /etc/haproxy/aws_ips.acl
    use_backend aws_backend if is_aws

Caddy

curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/caddy_cloudflare_allow.conf

Provider Matrix

ProviderIPv4IPv6ServicesRegionsMerged CIDRsAll Formats
AWSYYYYYY
AzureYYYYYY
Google CloudYYYYYY
Google ServicesYY——YY
OracleYYYYYY
CloudflareYY——YY
DigitalOceanYY——YY
FastlyYY——YY
GitHubYYY—YY
LinodeYY——YY
GoogleBotYY——YY
BingBotYY——YY
GPTBotY—Y—YY
ClaudeBotY———YY
AppleBotY———YY
Apple Private RelayYY—YYY
TelegramYY——YY
VultrYY—YYY
PerplexityBotYYY—YY
DuckDuckBotYY——YY
AmazonbotYYY—YY
Common CrawlYY——YY
ZoomYYY—YY
AtlassianYYYYYY
CircleCIY—Y—YY
TeamCityY—YYYY
DatadogYYY—YY
UptimeRobotYYYYYY
StatusCakeY———YY
PingdomYY——YY
Tor Exit NodesY———YY
MullvadYYYYYY
MetaYYY—YY
AlibabaYYY—YY
TencentYYY—YY
IBM CloudYYY—YY
HetznerYYY—YY
OVHcloudYYY—YY
ScalewayYYY—YY
AkamaiYYY—YY
LeasewebYYY—YY
RackspaceYYY—YY
SalesforceYYY—YY
ZscalerYYY—YY
YandexYYY—YY
Huawei CloudYYY—YY
Microsoft 365YY——YY
ImpervaYY——YY
G-Core LabsYY——YY
CacheFlyY———YY
GoCacheY———YY
Quic.cloudY———YY
ZohoYYY—YY
WasabiY—Y—YY
UpCloudYYY—YY
SucuriYYY—YY
StormWallYYY—YY
BaiduYYY—YY
BackblazeYYY—YY
NHN CloudY—Y—YY
HostwayY—Y—YY
GabiaY—Y—YY
Bunny CDNYYY—YY
DiscordY—Y—YY
ContaboYYY—YY
Play2GoY——YYY

Use Cases

  • Firewall rules — Allow only known cloud provider IPs to access your infrastructure
  • Bot management — Block or allow GoogleBot, BingBot, GPTBot/ChatGPT, AppleBot, PerplexityBot, DuckDuckBot, Amazonbot, CCBot crawlers
  • Privacy proxy detection — Identify iCloud Private Relay traffic using Apple's official egress IP list
  • AI crawler blocking — Use GPTBot IP lists to prevent AI training on your content
  • Security auditing — Identify whether suspicious IPs belong to cloud infrastructure
  • Compliance — Restrict traffic to specific cloud regions or services
  • WAF / CDN configuration — Whitelist upstream CDN IPs (Cloudflare, Fastly)
  • CI/CD security — Allow only GitHub Actions IPs to trigger deploys
  • SaaS whitelisting — Allow Atlassian (Jira, Confluence, Bitbucket) or Zoom webhook IPs through your firewall
  • Network analysis — Track how cloud IP space evolves over time via the changelog
  • IP attribution — Use the lookup tool to identify which cloud owns any IP

Automating Updates

All data updates daily at 02:00 UTC. Set up your systems to pull the latest:

For applying these ranges to a live webserver or firewall, ip-watch automates the whole loop — daily refresh, validation, reload, and rollback — instead of a hand-rolled cron job. See ip-watch — Apply & Auto-Sync to Your Servers above.

Clone and schedule

git clone https://github.com/rezmoss/cloud-provider-ip-addresses.git

# Cron job: pull daily at 00:30 UTC (30 min after update)
30 0 * * * cd /path/to/cloud-provider-ip-addresses && git pull

Direct download

# Download specific files on a schedule
30 0 * * * curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/nginx_aws_allow.conf -o /etc/nginx/conf.d/aws_allow.conf && sudo nginx -s reload

License

This project is dedicated to the public domain under the CC0 1.0 Universal Public Domain Dedication.

Acknowledgments

All IP range data is sourced from the official, publicly available endpoints provided by each respective organization. We are grateful to the following providers for making their network information openly accessible:

  • Amazon Web Services — for publishing their IP address ranges through their public JSON endpoint
  • Microsoft Azure — for maintaining downloadable Service Tags with comprehensive IP range data
  • Google Cloud Platform — for providing structured cloud IP range information
  • Cloudflare — for openly sharing their IPv4 and IPv6 edge network ranges
  • DigitalOcean — for publishing their IP allocations via their public geofeed
  • Discord — for publishing their egress IP addresses, including the Discordbot crawler, as a public JSON list
  • Oracle Cloud Infrastructure — for making their public IP ranges available in machine-readable format
  • Fastly — for providing their edge network IP list through their public API
  • GitHub — for exposing service-level IP ranges through their meta API
  • Linode (Akamai) — for maintaining a publicly accessible IP geofeed
  • Google Search (GoogleBot) — for documenting their crawler IP ranges for webmasters
  • Microsoft Bing (BingBot) — for publishing their crawler IP ranges to help site operators
  • OpenAI (GPTBot / ChatGPT) — for making their bot and crawler IP ranges publicly available
  • Apple (AppleBot) — for publishing their web crawler IP ranges for site operators
  • Apple (iCloud Private Relay) — for making Private Relay egress IP ranges available to help websites with geolocation and traffic analysis
  • Telegram — for publishing their official network CIDR ranges
  • Vultr (Constant) — for maintaining a publicly accessible IP geofeed
  • Play2Go — for publishing their IP ranges as an official RFC 8805 geofeed
  • Perplexity AI (PerplexityBot) — for making their bot and user-agent IP ranges publicly available
  • DuckDuckGo (DuckDuckBot) — for publishing their crawler IP ranges for webmasters
  • Amazon (Amazonbot) — for making their crawler and search bot IP ranges publicly available
  • Common Crawl (CCBot) — for publishing their crawler IP ranges to support the open web
  • Zoom — for making their service, phone, and CDN IP ranges available in machine-readable format
  • Atlassian — for publishing their product IP ranges covering Jira, Confluence, Bitbucket, Trello, and more
  • CircleCI — for publishing their build runner egress IP ranges, including the macOS fleet
  • JetBrains TeamCity Cloud — for publishing per-region build agent egress IP ranges
  • Datadog — for publishing their synthetics, webhooks, and service IP ranges in a machine-readable feed
  • UptimeRobot — for publishing their monitoring probe IP ranges through a public API
  • StatusCake — for publishing their monitoring probe IP ranges as a public list
  • Pingdom — for publishing their IPv4 and IPv6 monitoring probe IP ranges
  • The Tor Project — for publishing the official bulk exit node list as part of their network directory
  • Mullvad VPN — for publishing their complete relay list through their public API
  • Public BGP data sources — for the routing data from which the announced address space of Meta, Alibaba, Tencent, IBM Cloud, Hetzner, OVHcloud, Scaleway, and Contabo is observed

Star History

Star History Chart

apache
aws
azure
cidr
cidr-ranges
cloudflare
cloud-ip-ranges
cloud-security
devops
firewall
gcp
google
infrastructure
ip
ip-addresses
ip-ranges
nginx
security
webserver

rezmoss/cloud-provider-ip-addresses

Daily-updated IP ranges for 60+ providers (AWS, Azure, GCP, Cloudflare, GitHub, Fastly, Linode + GoogleBot, BingBot, GPTBot) in 13+ formats: TXT, JSON, CSV, SQL, Nginx, Apache, iptables, nftables, UFW, HAProxy, Caddy + merged CIDRs

Shell

199

761 commits

updated Oct 20, 2026

See the code

See what people are saying

SourceMessageScoreDate

From 22 to 67 providers: an update to my open-source cloud IP range dataset (r/selfhosted)

I shared an early version of this project here back in February, when it covered 22 providers. A few people asked what made it different from the other IP range lists, and there were good questions about how safely the output could be used I've continued working on it, and the dataset now covers 67…

4

Oct 13, 2026

README

Cloud Provider IP Addresses

The most comprehensive, daily-updated collection of IP ranges from cloud providers, CDNs, and web crawlers — in 13+ output formats.

GitHub stars GitHub license Last Updated Providers Formats Update

67 providers | 13+ output formats | Merged/optimized CIDRs | Firewall-ready configs | Unified cross-provider dataset | Daily changelog | IP lookup tool | Go & JS client libraries

Live Stats

Last updated: 2026-10-13 | Providers: 67 | Total CIDRs: 451,779 | IPv4 addresses: 459,450,004 | IPv4 space: 10.70%

ProviderIPv4 CIDRsIPv6 CIDRsTotal CIDRsIPv4 AddressesServicesRegions
akamai7,7983,02610,82421,643,472181
alibaba2,1542472,40131,628,80031
amazonbot3,13103,1313,13130
apple_private_relay41,734243,357285,091105,64701284
applebot240244,75210
atlassian1106017082,1141218
aws10,6306,94317,573188,289,4162743
azure69,39226,68296,074109,442,075332177
backblaze2659859,47221
baidu17714191665,60021
bingbot280284,73610
bunny1434484,09611
cachefly160164,09600
circleci520524,03131
claudebot380381,13610
cloudflare157221,524,73600
commoncrawl4152810
contabo74414758757,76031
datadog1541016438,362110
digitalocean1,0861481,2343,134,848013
discord200202020
duckduckbot486048648610
fastly21324353,28000
gabia144014452,60811
gcore9838441,82798300
github5,7041,5447,24828,377,223110
gocache2502560000
googlebot1701473175,08810
googlecloud1,032951,12719,302,528148
googleservices297973944,908,92811
gptbot291029141,76030
hetzner68776943,590,40031
hostway174017474,75211
huawei588936811,169,15261
ibmcloud340734133,756,03211
imperva11112261,12000
internetarchive8198,19221
leaseweb1,6833722,0552,404,864181
linode5,409965,5051,392,640038
meta346418764584,44831
microsoft3653459932,514,95700
mullvad5665561,122566250
nhncloud3770377137,72831
oracle1,10701,1074,349,962356
ovhcloud733447774,685,56811
perplexitybot120123220
pingdom1495720614900
play2go182018248,12815
quiccloud152015215200
rackspace312143262,298,880151
salesforce54559881,66451
scaleway4221632,580,73621
statuscake183018318300
stormwall157223,84011
sucuri1613295,63211
teamcity110111121
telegram951411,00800
tencent3,365723,43714,991,61621
tor1,20901,2091,20911
upcloud9321114105,47221
uptimerobot10310320610314
vultr443524951,044,992036
wasabi200205,12011
yandex12432156450,56061
zoho1711919078,59291
zoom55257539,92430
zscaler937841,0211,079,80841

Total IPv4 Coverage Over Time

Total routable IPv4 addresses tracked daily

Total routable IPv4 addresses across all tracked providers, updated daily since tracking began. Underlying data: stats_history.json.


Table of Contents


Why This Repo?

There are other cloud IP range repos out there. Here's what makes this one different:

FeatureThis RepoOthers
Cloud providersAWS, Azure, GCP, Cloudflare, DigitalOcean, Oracle, Fastly, GitHub, Linode, Vultr, Contabo, Play2Go, UpCloud, NHN Cloud, Hostway, Gabia + Apple Private Relay, TelegramVaries
CDN / storage / WAFG-Core Labs, CacheFly, GoCache, Quic.cloud, Bunny CDN, Wasabi, Backblaze, Imperva, Sucuri, StormWallRare
Bot/crawler IPsGoogleBot, BingBot, GPTBot/ChatGPT, ClaudeBot, AppleBot, PerplexityBot, DuckDuckBot, Amazonbot, Common CrawlRare
SaaS / CollaborationMicrosoft 365, Zoom, Atlassian (Jira, Confluence, Bitbucket, Trello, ...)Very rare
Output formats13+ (TXT, JSON, CSV, SQL, Nginx, Apache, iptables, nftables, UFW, HAProxy, Caddy, ipset, merged CIDRs)Usually 1-3
Merged/optimized CIDRsPer-provider and combinedRare
Unified cross-provider fileall_providers.json / .csv with normalized schemaRare
Service/region breakdownPer-service and per-region files for AWS, Azure, GCP, Oracle, GitHub, GPTBot, Apple Private Relay, Vultr, PerplexityBot, Amazonbot, Zoom, AtlassianSome
IP lookup toollookup.py — "which cloud owns this IP?"Separate projects
ChangelogDaily diff tracking (CIDRs added/removed)Rare
StatisticsSTATS.md + summary.json with IPv4 space coverageRare
Update frequencyDaily at 02:00 UTCVaries
Firewall-ready configsNginx, Apache, iptables, nftables, UFW, HAProxy, CaddyUsually 0-1

Quick Start

Grab what you need with a single command:

# All AWS IPs (plain text)
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws_ips.txt

# Cloudflare IPv4 only
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/cloudflare_ips_v4.txt

# All providers merged into one optimized IPv4 list
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers_merged_v4.txt

# Block GPTBot with iptables
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/gptbot/iptables_gptbot_deny.sh | sudo bash

# AWS Nginx allow config — drop into your server block
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/nginx_aws_allow.conf -o /etc/nginx/conf.d/aws_allow.conf

# Unified dataset (all providers, normalized JSON)
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers.json

# Look up an IP
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/lookup.py -o lookup.py
python3 lookup.py --data-dir . 13.32.0.1

Download Mirrors (jsDelivr CDN)

Every file in this repo is also served from the free, globally-cached jsDelivr CDN. Use it for faster downloads and to avoid GitHub's raw.githubusercontent.com rate limits — handy when many servers pull on a schedule.

Swap the host and path prefix:

raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/<path>
        ↓
cdn.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/<path>
# Same files, via CDN
curl -sL https://cdn.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/aws/aws_ips.txt
curl -sL https://cdn.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/all_providers/all_providers_merged_v4.txt

# Fastly-backed fallback host (same paths)
curl -sL https://fastly.jsdelivr.net/gh/rezmoss/cloud-provider-ip-addresses@main/cloudflare/cloudflare_ips_v4.txt
  • @main — always the latest daily data. Our update workflow purges the jsDelivr cache for key files on every push, so @main refreshes within minutes instead of waiting out the CDN's default cache window.
  • @vYYYY.MM.DD — pin a specific dated release for reproducible, immutable downloads (e.g. [email protected]/aws/aws_ips.txt).

Note: GitHub's raw.githubusercontent.com URLs continue to work unchanged. jsDelivr is an optional, faster mirror.

Versioned Release Bundles

Each daily run also publishes a GitHub Release (tagged vYYYY.MM.DD) with the entire dataset bundled as a single download, plus SHA-256 checksums for integrity verification:

# Latest full dataset — always resolves to the most recent release
curl -sLO https://github.com/rezmoss/cloud-provider-ip-addresses/releases/latest/download/all_providers.zip
curl -sLO https://github.com/rezmoss/cloud-provider-ip-addresses/releases/latest/download/SHA256SUMS

# Verify the bundle, then extract
sha256sum -c SHA256SUMS --ignore-missing
unzip all_providers.zip -d cloud-ips

Pin a specific date for reproducible, immutable downloads:

curl -sLO https://github.com/rezmoss/cloud-provider-ip-addresses/releases/download/v2026.06.17/all_providers.zip

SHA256SUMS lists checksums for every file in the dataset, so after extracting you can re-run sha256sum -c SHA256SUMS inside the extracted directory to verify all files.


Supported Providers

Cloud Providers

ProviderIPsServicesRegionsSource
AWSIPv4 + IPv6Per-service (EC2, S3, CloudFront, ...)Per-regionAWS public IP ranges
Microsoft AzureIPv4 + IPv6Per-service (AzureCloud, AppService, ...)Per-regionAzure Service Tags
Google CloudIPv4 + IPv6Per-servicePer-scopeGCP public IP ranges
Google ServicesIPv4 + IPv6——Google-owned ranges outside GCP customer space (goog.json minus cloud.json)
CloudflareIPv4 + IPv6——Cloudflare published IP list
DigitalOceanIPv4 + IPv6—Per-regionDigitalOcean public geofeed
Oracle CloudIPv4 + IPv6Per-service (tags)Per-regionOracle Cloud public IP ranges

CDN / Hosting

ProviderIPsServicesSource
FastlyIPv4 + IPv6—Fastly public IP list
GitHubIPv4 + IPv6Per-service (actions, pages, copilot, hooks, web, api, ...)GitHub Meta API
Linode (Akamai)IPv4 + IPv6—Linode public geofeed
Apple (iCloud Private Relay)IPv4 + IPv6—Apple published egress ranges
VultrIPv4 + IPv6Per-regionVultr public geofeed
Play2GoIPv4Per-countryPlay2Go official geofeed
TelegramIPv4 + IPv6—Telegram official CIDR list
ImpervaIPv4 + IPv6—Imperva cloud WAF / CDN IP feed
G-Core LabsIPv4 + IPv6—G-Core CDN public IP list
CacheFlyIPv4 + IPv6—CacheFly edge IP list
GoCacheIPv4 + IPv6—GoCache CDN IP list
Quic.cloudIPv4 + IPv6—QUIC.cloud CDN IP list

SaaS / Collaboration

ProviderIPsServicesSource
ZoomIPv4 + IPv6Per-service (zoom, zoom-phone, zoom-contact-center, zoom-cdn)Zoom published IP ranges
AtlassianIPv4 + IPv6Per-product (Jira, Confluence, Bitbucket, Trello, ...)Atlassian published IP ranges
Microsoft 365IPv4 + IPv6—Microsoft 365 worldwide endpoints API
DiscordIPv4Per-service (api, media)Discord published egress IP list (incl. Discordbot link previews)

CI/CD & Monitoring

ProviderIPsServices / RegionsSource
CircleCIIPv4Per-service (incl. macOS fleet)CircleCI published runner egress ranges
TeamCity CloudIPv4Per-service + per-regionJetBrains TeamCity Cloud build-agent ranges
DatadogIPv4 + IPv6Per-service (synthetics, webhooks, agent, ...)Datadog published IP ranges feed
UptimeRobotIPv4 + IPv6Per-service + per-regionUptimeRobot monitoring probe API
StatusCakeIPv4—StatusCake monitoring probe locations
PingdomIPv4 + IPv6—Pingdom monitoring probe IP list

Bots / Crawlers

BotIPsServicesSource
GoogleBotIPv4 + IPv6googlebotGoogle published crawler ranges
BingBotIPv4 + IPv6bingbotMicrosoft published crawler ranges
GPTBot / ChatGPT / SearchBotIPv4Per-service (gptbot, chatgpt-user, searchbot)OpenAI published bot ranges
ClaudeBot / Claude-User / Claude-SearchBotIPv4claudebotAnthropic published crawler ranges
AppleBotIPv4applebotApple published crawler ranges
PerplexityBotIPv4 + IPv6Per-service (perplexitybot, perplexity-user)Perplexity published bot ranges
DuckDuckBotIPv4 + IPv6duckduckbotDuckDuckGo published crawler ranges
AmazonbotIPv4 + IPv6Per-service (amazonbot, amzn-searchbot, amzn-user)Amazon published bot ranges
Common Crawl (CCBot)IPv4 + IPv6ccbotCommon Crawl published bot ranges

VPN / Anonymizer Networks

ProviderIPsServicesSource
Tor Exit NodesIPv4tor-exitOfficial Tor Project bulk exit list
Mullvad VPNIPv4 + IPv6Per-type (wireguard, bridge) + per-countryOfficial Mullvad relay API

BGP / ASN-Derived Networks

These entities publish no official IP range feed. Their ranges are derived from live BGP announcements of their officially registered ASNs, observed via public BGP data sources. They cover all address space the entity originates (not only cloud/customer ranges) and may miss space routed through partner networks. The table below lists the exact ASNs used.

ProviderIPsSource
AkamaiIPv4 + IPv6BGP announcements via public BGP data
Alibaba (Alibaba Cloud / Alibaba Group)IPv4 + IPv6BGP announcements via public BGP data
BackblazeIPv4 + IPv6BGP announcements via public BGP data
BaiduIPv4 + IPv6BGP announcements via public BGP data
Bunny CDNIPv4 + IPv6BGP announcements via public BGP data
ContaboIPv4 + IPv6BGP announcements via public BGP data
GabiaIPv4 + IPv6BGP announcements via public BGP data
HetznerIPv4 + IPv6BGP announcements via public BGP data
HostwayIPv4 + IPv6BGP announcements via public BGP data
Huawei CloudIPv4 + IPv6BGP announcements via public BGP data
IBM Cloud (SoftLayer)IPv4 + IPv6BGP announcements via public BGP data
Internet ArchiveIPv4 + IPv6BGP announcements via public BGP data
LeasewebIPv4 + IPv6BGP announcements via public BGP data
Meta (Facebook / Instagram / WhatsApp)IPv4 + IPv6BGP announcements via public BGP data
NHN CloudIPv4 + IPv6BGP announcements via public BGP data
OVHcloudIPv4 + IPv6BGP announcements via public BGP data
RackspaceIPv4 + IPv6BGP announcements via public BGP data
SalesforceIPv4 + IPv6BGP announcements via public BGP data
ScalewayIPv4 + IPv6BGP announcements via public BGP data
StormWallIPv4 + IPv6BGP announcements via public BGP data
SucuriIPv4 + IPv6BGP announcements via public BGP data
Tencent (Tencent Cloud / Tencent Group)IPv4 + IPv6BGP announcements via public BGP data
UpCloudIPv4 + IPv6BGP announcements via public BGP data
WasabiIPv4 + IPv6BGP announcements via public BGP data
YandexIPv4 + IPv6BGP announcements via public BGP data
ZohoIPv4 + IPv6BGP announcements via public BGP data
ZscalerIPv4 + IPv6BGP announcements via public BGP data

Per-Provider Pages

Each provider has its own page with quick-use snippets, sample CIDRs, and links to every output format.

ProviderPage
Akamaiakamai/
Alibaba (Alibaba Cloud / Alibaba Group)alibaba/
Amazonbotamazonbot/
Apple iCloud Private Relayapple_private_relay/
Applebotapplebot/
Atlassianatlassian/
Amazon Web Servicesaws/
Microsoft Azureazure/
Backblazebackblaze/
Baidubaidu/
Bingbotbingbot/
Bunny CDNbunny/
CacheFlycachefly/
CircleCIcircleci/
ClaudeBotclaudebot/
Cloudflarecloudflare/
Common Crawl (CCBot)commoncrawl/
Contabocontabo/
Datadogdatadog/
DigitalOceandigitalocean/
Discorddiscord/
DuckDuckBotduckduckbot/
Fastlyfastly/
Gabiagabia/
G-Core Labsgcore/
GitHubgithub/
GoCachegocache/
Googlebotgooglebot/
Google Cloud Platformgooglecloud/
Google Servicesgoogleservices/
OpenAI GPTBot / ChatGPT-User / SearchBotgptbot/
Hetznerhetzner/
Hostwayhostway/
Huawei Cloudhuawei/
IBM Cloud (SoftLayer)ibmcloud/
Impervaimperva/
Internet Archiveinternetarchive/
Leasewebleaseweb/
Linode (Akamai)linode/
Meta (Facebook / Instagram / WhatsApp)meta/
Microsoft 365microsoft365/
Mullvad VPNmullvad/
NHN Cloudnhncloud/
Oracle Cloud Infrastructureoracle/
OVHcloudovhcloud/
PerplexityBotperplexitybot/
Pingdompingdom/
Play2Goplay2go/
Quic.cloudquiccloud/
Rackspacerackspace/
Salesforcesalesforce/
Scalewayscaleway/
StatusCakestatuscake/
StormWallstormwall/
Sucurisucuri/
TeamCity Cloudteamcity/
Telegramtelegram/
Tencent (Tencent Cloud / Tencent Group)tencent/
Tor Exit Nodestor/
UpCloudupcloud/
UptimeRobotuptimerobot/
Vultrvultr/
Wasabiwasabi/
Yandexyandex/
Zohozoho/
Zoomzoom/
Zscalerzscaler/

Output Formats

Every provider gets all of these formats:

FormatFilesDescription
TXT{provider}_ips.txt, _v4.txt, _v6.txtOne CIDR per line
JSON{provider}_ips.jsonStructured with ip_address, ip_type, service, region
CSV{provider}_ips.csvTabular format for spreadsheets/databases
SQL{provider}_ips.sqlCREATE TABLE + INSERT statements
Nginxnginx_{provider}_allow.conf, _deny.confallow/deny rules with deny all/allow all
Apacheapache_{provider}_allow.conf, _deny.confRequire ip / Deny from directives
iptablesiptables_{provider}_allow.sh, _deny.shShell scripts with iptables/ip6tables rules
nftablesnftables_{provider}_allow.conf, _deny.confnftables table/chain definitions
UFWufw_{provider}_allow.sh, _deny.shufw allow/deny from commands
HAProxyhaproxy_{provider}_allow.confACL-compatible IP list
Caddycaddy_{provider}_allow.confremote_ip matcher block
ipset{provider}.netsetipset restore-loadable hash:net sets (IPv4 + IPv6)
Merged CIDRs{provider}_ips_merged_v4.txt, _merged_v6.txtOptimized/collapsed CIDR lists
Metadata{provider}_meta.jsonVersion, freshness dates, and subnet/address counts

For providers with service/region data (AWS, Azure, GCP, Oracle, GitHub, GPTBot, Apple Private Relay, Vultr, PerplexityBot, Amazonbot, Zoom, Atlassian), all formats are also generated per-service and per-region. (ipset and metadata are generated at the provider level.)

ipset (large lists)

For providers with thousands of CIDRs (Azure, AWS, Apple Private Relay, ...), one iptables/ufw rule per range is impractical. The ipset format loads the whole set into a kernel hash table that a single firewall rule can match in O(1):

# Load the set (defines {provider}_v4 and {provider}_v6)
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws.netset | sudo ipset restore -!

# Match it from one iptables rule
sudo iptables -A INPUT -m set --match-set aws_v4 src -j ACCEPT
sudo ip6tables -A INPUT -m set --match-set aws_v6 src -j ACCEPT

Note: ipset is the iptables-era tool. On nftables-based systems, use the provided nftables_{provider}_allow.conf (nftables has native sets).

Metadata & change detection

Each provider ships a {provider}_meta.json with a monotonic version that increments only when the IP set actually changes, plus generated_date, last_changed_date, per-family subnet/address counts, and a content_sha256. Poll version (or the .netset header) to decide whether to reload your firewall — no need to diff the full list:

curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/cloudflare_meta.json
# { "provider": "cloudflare", "version": 1, "generated_date": "...", "last_changed_date": "...",
#   "ipv4": { "cidrs": 15, "merged_cidrs": 15, "addresses": 1524736 }, ... }

Merged / Optimized CIDRs

Adjacent and overlapping CIDR blocks are collapsed into the smallest possible list using ipaddress.collapse_addresses(). This is ideal for firewall rules where you need the most compact representation.

# AWS optimized IPv4 list
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws_ips_merged_v4.txt

# All providers combined into one merged list
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers_merged_v4.txt

Each provider directory contains:

  • {provider}_ips_merged_v4.txt — optimized IPv4 CIDRs
  • {provider}_ips_merged_v6.txt — optimized IPv6 CIDRs
  • {provider}_ips_merged.txt — both combined

Unified Cross-Provider Data

A single normalized dataset across all providers, available in all_providers/:

FileDescription
all_providers.jsonAll CIDRs with cidr, ip_version, provider, service, region, last_updated
all_providers.csvSame data in CSV
all_providers_ips.txtAll CIDRs, one per line
all_providers_merged_v4.txtAll providers merged into one optimized IPv4 list
all_providers_merged_v6.txtAll providers merged into one optimized IPv6 list
# Query all providers with jq — find all Azure CIDRs in eastus
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/all_providers/all_providers.json \
  | jq '[.[] | select(.provider=="azure" and .region=="eastus")]'

IP Lookup Tool

Find which cloud provider owns any IP address:

# Download the tool and data
git clone https://github.com/rezmoss/cloud-provider-ip-addresses.git
cd cloud-provider-ip-addresses

# Single IP
python3 lookup.py 13.32.0.1
# Output: 13.32.0.1 — AWS (AMAZON, us-east-1) [13.32.0.0/15]

# Multiple IPs
python3 lookup.py 13.32.0.1 104.16.0.1 168.63.129.16

# Batch mode from file
python3 lookup.py --file suspicious_ips.txt

# JSON output
python3 lookup.py --json 8.8.8.8

Fast Lookup (Radix Tree)

For large-scale lookups, radix_lookup.py uses a radix tree pysubnettree (github.com/zeek/pysubnettree) for O(1) lookups — 2M+ IPs/sec for IPv4, 1.6M+ IPs/sec for IPv6. Same interface and output as lookup.py.

pip3 install -r requirements.txt
python3 radix_lookup.py 13.32.0.1
python3 radix_lookup.py --file suspicious_ips.txt
python3 radix_lookup.py --json 8.8.8.8

ip-watch — Apply & Auto-Sync to Your Servers

The files in this repo tell you what the IP ranges are. ip-watch is the official companion that applies them — it keeps these ranges enforced on your webserver and firewall on a daily schedule, with validation and safe rollback, so you never hand-edit a config or babysit a cron job again.

Keep cloud-provider IP ranges applied to your webserver and firewall, on a daily schedule with safe rollback.

A single static Go binary (~7 MB, zero runtime dependencies) that consumes this dataset directly.

What it does for you:

  • 7 engines — nginx, Caddy, Apache, HAProxy (config layer) and nftables, iptables, ufw (firewall layer)
  • Allow or deny modes — whitelist trusted clouds/CDNs, or blocklist AI crawlers (GPTBot, CCBot, ...) and Tor exit nodes
  • Merge across providers — combine multiple providers into a single target (e.g. Cloudflare + Fastly allowlist)
  • Pre-validation + atomic rollback — every change is checked with the engine's native validator (nginx -t, caddy validate, ...) and reverted automatically if validation or reload fails
  • Anti-lockout design — SSH protection and escape hatches so a bad rule can't lock you out of your own box
  • Daily auto-refresh with change detection, plus a Web UI + CLI, /healthz, Prometheus metrics, and Slack/Mattermost webhooks
  • Docker support and signed, multi-arch release artifacts
# Install (one-liner)
curl -fsSL https://raw.githubusercontent.com/rezmoss/ip-watch/main/install.sh | sudo sh
# also available via apt, dnf, zypper, Homebrew, Nix, and ghcr.io/rezmoss/ip-watch

# Add Cloudflare's ranges to an nginx vhost and enforce immediately
sudo ip-watch add -id cf -provider cloudflare -engine nginx \
    -selector example.com -apply

ip-watch providers          # list available providers with CIDR counts
ip-watch apply --dry        # preview changes without touching anything
ip-watch status             # per-target state
ip-watch history -n 50      # recent operations

Full docs, configuration, and engine guides: ip-watch README.


Client Libraries (Go & JavaScript)

Prefer to consume this data from code instead of curling raw files? Two official client libraries ship with auto-updating, offline-capable IP detection for AWS, GCP, Azure, Cloudflare, DigitalOcean, and Oracle Cloud. Both pull from a compiled binary index (cloudip-db) derived from this repository's daily output, with SHA-256-verified updates and an embedded fallback for air-gapped environments.

Go — go-cloudip

Sub-microsecond lookups via Patricia trie. Thread-safe, lock-free reads.

go get github.com/rezmoss/go-cloudip
import "github.com/rezmoss/go-cloudip"

cloudip.IsAWS("52.94.76.1")           // true
cloudip.GetProvider("34.64.0.1")      // "gcp"
cloudip.IsCloudProvider("104.16.0.1") // true

result := cloudip.Lookup("52.94.76.1")
// result.Provider, result.Region, result.Service, result.CIDR

Full API, custom detectors, offline mode, and auto-update options: go-cloudip README.

JavaScript / TypeScript — js-cloudip

Node.js and browser (CORS-friendly). TypeScript types included. Ships a CLI and a forward-lookup mode ("give me every Cloudflare CIDR").

npm install js-cloudip
import { lookup, getProvider, isAws, getIPs } from 'js-cloudip';

await isAws('52.94.76.1');         // true
await getProvider('34.64.0.1');    // "gcp"

const r = await lookup('52.94.76.1');
// { found: true, provider: 'aws', region: 'us-east-1', service: 'EC2', cidr: '52.94.0.0/16', ip_type: 'ipv4' }

const cf = await getIPs('cloudflare'); // all Cloudflare CIDRs

Use the /embedded subpath for offline / air-gapped use, or the cloudip CLI:

npx cloudip lookup 52.94.76.1
npx cloudip get cloudflare

Full API, browser usage, and configuration: js-cloudip README.

Note: the libraries currently cover the six major cloud providers above. The full 37-provider dataset (CDNs, SaaS, bots/crawlers, VPNs, BGP-derived networks) remains available as raw files in this repo.


Changelog & Stats

Daily Changelog

IP range changes are tracked daily in CHANGELOG.md and machine-readable diffs in changes/:

  • CHANGELOG.md — human-readable summary of CIDRs added/removed per provider
  • changes/{date}.json — machine-readable daily diff

Statistics

  • STATS.md — per-provider IPv4/IPv6 CIDR counts, total addresses, services, regions
  • summary.json — machine-readable version with IPv4 space coverage percentage
# Check today's changes
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/CHANGELOG.md

# Get stats as JSON
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/summary.json

Folder Structure

cloud-provider-ip-addresses/
├── aws/
│   ├── aws_ips.txt / _v4.txt / _v6.txt
│   ├── aws_ips.json / .csv / .sql
│   ├── aws_ips_merged_v4.txt / _merged_v6.txt / _merged.txt
│   ├── nginx_aws_allow.conf / _deny.conf
│   ├── apache_aws_allow.conf / _deny.conf
│   ├── iptables_aws_allow.sh / _deny.sh
│   ├── nftables_aws_allow.conf / _deny.conf
│   ├── ufw_aws_allow.sh / _deny.sh
│   ├── haproxy_aws_allow.conf
│   ├── caddy_aws_allow.conf
│   ├── aws.netset                    (ipset restore-loadable)
│   ├── aws_meta.json                 (version + freshness + counts)
│   ├── services/
│   │   └── ec2/ s3/ cloudfront/ ...  (all formats per service)
│   └── regions/
│       └── us_east_1/ eu_west_1/ ...  (all formats per region)
├── azure/                (same structure)
├── googlecloud/          (same structure)
├── googleservices/       (all formats, no services/regions)
├── oracle/               (same structure)
├── cloudflare/           (all formats, no services/regions)
├── digitalocean/         (all formats, no services/regions)
├── fastly/               (all formats)
├── github/               (all formats + services)
├── linode/               (all formats)
├── googlebot/            (all formats)
├── bingbot/              (all formats)
├── gptbot/               (all formats + services)
├── claudebot/            (all formats)
├── applebot/             (all formats)
├── apple_private_relay/  (all formats + regions)
├── telegram/             (all formats)
├── vultr/                (all formats + regions)
├── perplexitybot/        (all formats + services)
├── duckduckbot/          (all formats)
├── amazonbot/            (all formats + services)
├── commoncrawl/          (all formats)
├── zoom/                 (all formats + services)
├── atlassian/            (all formats + services + regions)
├── circleci/             (all formats + services)
├── teamcity/             (all formats + services + regions)
├── datadog/              (all formats + services)
├── uptimerobot/          (all formats + services + regions)
├── statuscake/           (all formats)
├── pingdom/              (all formats)
├── meta/                 (all formats + services; BGP/ASN-derived)
├── alibaba/              (all formats + services; BGP/ASN-derived)
├── tencent/              (all formats + services; BGP/ASN-derived)
├── ibmcloud/             (all formats + services; BGP/ASN-derived)
├── hetzner/              (all formats + services; BGP/ASN-derived)
├── ovhcloud/             (all formats + services; BGP/ASN-derived)
├── scaleway/             (all formats + services; BGP/ASN-derived)
├── akamai/               (all formats + services; BGP/ASN-derived)
├── leaseweb/             (all formats + services; BGP/ASN-derived)
├── rackspace/            (all formats + services; BGP/ASN-derived)
├── salesforce/           (all formats + services; BGP/ASN-derived)
├── zscaler/              (all formats + services; BGP/ASN-derived)
├── yandex/               (all formats + services; BGP/ASN-derived)
├── huawei/               (all formats + services; BGP/ASN-derived)
├── tor/                  (all formats; official Tor Project exit list)
├── mullvad/              (all formats + services + regions)
├── microsoft365/         (all formats; official Microsoft 365 endpoints feed)
├── imperva/              (all formats; official Imperva WAF/CDN feed)
├── gcore/                (all formats; official G-Core Labs CDN feed)
├── cachefly/             (all formats; official CacheFly edge list)
├── gocache/              (all formats; official GoCache CDN feed)
├── quiccloud/            (all formats; official QUIC.cloud CDN list)
├── zoho/                 (all formats + services; BGP/ASN-derived)
├── wasabi/               (all formats + services; BGP/ASN-derived)
├── upcloud/              (all formats + services; BGP/ASN-derived)
├── sucuri/               (all formats + services; BGP/ASN-derived)
├── stormwall/            (all formats + services; BGP/ASN-derived)
├── baidu/                (all formats + services; BGP/ASN-derived)
├── backblaze/            (all formats + services; BGP/ASN-derived)
├── nhncloud/             (all formats + services; BGP/ASN-derived)
├── hostway/              (all formats + services; BGP/ASN-derived)
├── gabia/                (all formats + services; BGP/ASN-derived)
├── bunny/                (all formats + services; BGP/ASN-derived)
├── internetarchive/      (all formats + services; BGP/ASN-derived)
├── discord/              (all formats + services; official Discord egress list)
├── contabo/              (all formats + services; BGP/ASN-derived)
├── play2go/              (all formats + regions; official Play2Go geofeed)
├── all_providers/
│   ├── all_providers.json / .csv
│   ├── all_providers_ips.txt
│   └── all_providers_merged_v4.txt / _merged_v6.txt
├── changes/
│   └── {date}.json       (daily diffs)
├── CHANGELOG.md
├── STATS.md
├── summary.json
├── lookup.py
├── LICENSE
└── README.md

Usage Examples

curl One-Liners

# Get all AWS IPs
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/aws_ips.txt

# Get GitHub Actions IPs only
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/github/services/actions/github_actions_ips.txt

# Get GPTBot IPs to block AI crawlers
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/gptbot/gptbot_ips.txt

# Get optimized Cloudflare list for firewall
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/cloudflare_ips_merged_v4.txt

Nginx

# Download and include
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/nginx_aws_allow.conf \
  -o /etc/nginx/conf.d/aws_allow.conf
server {
    # Allow only AWS IPs
    include /etc/nginx/conf.d/aws_allow.conf;
}
sudo nginx -s reload

Apache

curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/apache_aws_allow.conf \
  -o /etc/apache2/conf-available/aws_allow.conf
<Directory /var/www/html>
    AllowOverride None
    Require all denied
    Include /etc/apache2/conf-available/aws_allow.conf
</Directory>
sudo systemctl reload apache2

iptables

# Allow all Azure IPs
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/azure/iptables_azure_allow.sh | sudo bash

# Block GPTBot
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/gptbot/iptables_gptbot_deny.sh | sudo bash

UFW

# Allow GitHub Actions IPs
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/github/services/actions/ufw_github_actions_allow.sh | sudo bash

nftables

# Download nftables config
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/nftables_cloudflare_allow.conf \
  -o /etc/nftables.d/cloudflare_allow.conf

HAProxy

# Download ACL file
curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/haproxy_aws_allow.conf \
  -o /etc/haproxy/aws_ips.acl
frontend http
    acl is_aws src -f /etc/haproxy/aws_ips.acl
    use_backend aws_backend if is_aws

Caddy

curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/cloudflare/caddy_cloudflare_allow.conf

Provider Matrix

ProviderIPv4IPv6ServicesRegionsMerged CIDRsAll Formats
AWSYYYYYY
AzureYYYYYY
Google CloudYYYYYY
Google ServicesYY——YY
OracleYYYYYY
CloudflareYY——YY
DigitalOceanYY——YY
FastlyYY——YY
GitHubYYY—YY
LinodeYY——YY
GoogleBotYY——YY
BingBotYY——YY
GPTBotY—Y—YY
ClaudeBotY———YY
AppleBotY———YY
Apple Private RelayYY—YYY
TelegramYY——YY
VultrYY—YYY
PerplexityBotYYY—YY
DuckDuckBotYY——YY
AmazonbotYYY—YY
Common CrawlYY——YY
ZoomYYY—YY
AtlassianYYYYYY
CircleCIY—Y—YY
TeamCityY—YYYY
DatadogYYY—YY
UptimeRobotYYYYYY
StatusCakeY———YY
PingdomYY——YY
Tor Exit NodesY———YY
MullvadYYYYYY
MetaYYY—YY
AlibabaYYY—YY
TencentYYY—YY
IBM CloudYYY—YY
HetznerYYY—YY
OVHcloudYYY—YY
ScalewayYYY—YY
AkamaiYYY—YY
LeasewebYYY—YY
RackspaceYYY—YY
SalesforceYYY—YY
ZscalerYYY—YY
YandexYYY—YY
Huawei CloudYYY—YY
Microsoft 365YY——YY
ImpervaYY——YY
G-Core LabsYY——YY
CacheFlyY———YY
GoCacheY———YY
Quic.cloudY———YY
ZohoYYY—YY
WasabiY—Y—YY
UpCloudYYY—YY
SucuriYYY—YY
StormWallYYY—YY
BaiduYYY—YY
BackblazeYYY—YY
NHN CloudY—Y—YY
HostwayY—Y—YY
GabiaY—Y—YY
Bunny CDNYYY—YY
DiscordY—Y—YY
ContaboYYY—YY
Play2GoY——YYY

Use Cases

  • Firewall rules — Allow only known cloud provider IPs to access your infrastructure
  • Bot management — Block or allow GoogleBot, BingBot, GPTBot/ChatGPT, AppleBot, PerplexityBot, DuckDuckBot, Amazonbot, CCBot crawlers
  • Privacy proxy detection — Identify iCloud Private Relay traffic using Apple's official egress IP list
  • AI crawler blocking — Use GPTBot IP lists to prevent AI training on your content
  • Security auditing — Identify whether suspicious IPs belong to cloud infrastructure
  • Compliance — Restrict traffic to specific cloud regions or services
  • WAF / CDN configuration — Whitelist upstream CDN IPs (Cloudflare, Fastly)
  • CI/CD security — Allow only GitHub Actions IPs to trigger deploys
  • SaaS whitelisting — Allow Atlassian (Jira, Confluence, Bitbucket) or Zoom webhook IPs through your firewall
  • Network analysis — Track how cloud IP space evolves over time via the changelog
  • IP attribution — Use the lookup tool to identify which cloud owns any IP

Automating Updates

All data updates daily at 02:00 UTC. Set up your systems to pull the latest:

For applying these ranges to a live webserver or firewall, ip-watch automates the whole loop — daily refresh, validation, reload, and rollback — instead of a hand-rolled cron job. See ip-watch — Apply & Auto-Sync to Your Servers above.

Clone and schedule

git clone https://github.com/rezmoss/cloud-provider-ip-addresses.git

# Cron job: pull daily at 00:30 UTC (30 min after update)
30 0 * * * cd /path/to/cloud-provider-ip-addresses && git pull

Direct download

# Download specific files on a schedule
30 0 * * * curl -sL https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/aws/nginx_aws_allow.conf -o /etc/nginx/conf.d/aws_allow.conf && sudo nginx -s reload

License

This project is dedicated to the public domain under the CC0 1.0 Universal Public Domain Dedication.

Acknowledgments

All IP range data is sourced from the official, publicly available endpoints provided by each respective organization. We are grateful to the following providers for making their network information openly accessible:

  • Amazon Web Services — for publishing their IP address ranges through their public JSON endpoint
  • Microsoft Azure — for maintaining downloadable Service Tags with comprehensive IP range data
  • Google Cloud Platform — for providing structured cloud IP range information
  • Cloudflare — for openly sharing their IPv4 and IPv6 edge network ranges
  • DigitalOcean — for publishing their IP allocations via their public geofeed
  • Discord — for publishing their egress IP addresses, including the Discordbot crawler, as a public JSON list
  • Oracle Cloud Infrastructure — for making their public IP ranges available in machine-readable format
  • Fastly — for providing their edge network IP list through their public API
  • GitHub — for exposing service-level IP ranges through their meta API
  • Linode (Akamai) — for maintaining a publicly accessible IP geofeed
  • Google Search (GoogleBot) — for documenting their crawler IP ranges for webmasters
  • Microsoft Bing (BingBot) — for publishing their crawler IP ranges to help site operators
  • OpenAI (GPTBot / ChatGPT) — for making their bot and crawler IP ranges publicly available
  • Apple (AppleBot) — for publishing their web crawler IP ranges for site operators
  • Apple (iCloud Private Relay) — for making Private Relay egress IP ranges available to help websites with geolocation and traffic analysis
  • Telegram — for publishing their official network CIDR ranges
  • Vultr (Constant) — for maintaining a publicly accessible IP geofeed
  • Play2Go — for publishing their IP ranges as an official RFC 8805 geofeed
  • Perplexity AI (PerplexityBot) — for making their bot and user-agent IP ranges publicly available
  • DuckDuckGo (DuckDuckBot) — for publishing their crawler IP ranges for webmasters
  • Amazon (Amazonbot) — for making their crawler and search bot IP ranges publicly available
  • Common Crawl (CCBot) — for publishing their crawler IP ranges to support the open web
  • Zoom — for making their service, phone, and CDN IP ranges available in machine-readable format
  • Atlassian — for publishing their product IP ranges covering Jira, Confluence, Bitbucket, Trello, and more
  • CircleCI — for publishing their build runner egress IP ranges, including the macOS fleet
  • JetBrains TeamCity Cloud — for publishing per-region build agent egress IP ranges
  • Datadog — for publishing their synthetics, webhooks, and service IP ranges in a machine-readable feed
  • UptimeRobot — for publishing their monitoring probe IP ranges through a public API
  • StatusCake — for publishing their monitoring probe IP ranges as a public list
  • Pingdom — for publishing their IPv4 and IPv6 monitoring probe IP ranges
  • The Tor Project — for publishing the official bulk exit node list as part of their network directory
  • Mullvad VPN — for publishing their complete relay list through their public API
  • Public BGP data sources — for the routing data from which the announced address space of Meta, Alibaba, Tencent, IBM Cloud, Hetzner, OVHcloud, Scaleway, and Contabo is observed

Star History

Star History Chart

apache
aws
azure
cidr
cidr-ranges
cloudflare
cloud-ip-ranges
cloud-security
devops
firewall
gcp
google
infrastructure
ip
ip-addresses
ip-ranges
nginx
security
webserver

Significant stargazers

Git'Fellow

43 followers · starred Apr 2026

Sunny

185 followers · starred Sep 2026

John Taylor

62 followers · starred May 2026

Gürkan

34 followers · starred Feb 2025