Cloud IP Range Lookup: AWS, Azure, GCP, Cloudflare, Bots

Find out who owns an IP address in one run: AWS, Microsoft Azure, Google Cloud, Microsoft 365, Oracle Cloud, DigitalOcean, Cloudflare, Fastly, Bunny CDN, GitHub, Atlassian, or a verified search or AI crawler (Googlebot, Bingbot, GPTBot, ChatGPT-User, OAI-SearchBot). For every IP you get the provider, service (for example EC2, AzureStorage, Exchange Online, actions), region and the matching prefix.

Or flip it around: export the official ranges for any provider, service and region as clean CIDR rows and a plain-text allowlist, ready for a firewall, WAF, NSG, security group or proxy rule.

Every range is downloaded fresh at run time from each provider's official published list (AWS ip-ranges.json, Azure Service Tags, Google cloud.json / goog.json, the Microsoft 365 endpoints web service, Cloudflare, Fastly, GitHub meta, Atlassian, Google, Bing and OpenAI crawler lists). No API keys, no reverse DNS guesswork, no third-party IP database.

Who it's for

• Security and SOC analysts triaging firewall, VPN, sign-in or web logs: is this traffic from a cloud VM, a CDN, Microsoft 365, GitHub Actions, or a real Googlebot?
• SEO and web teams separating verified Googlebot / Bingbot / GPTBot hits from fake crawlers spoofing the user agent
• Network and cloud engineers building allowlists: "all Azure Storage IPs in West US 2", "GitHub webhook IPs", "Exchange Online ranges", "AWS us-east-1 EC2"
• Fraud and anti-abuse teams flagging sign-ups and transactions coming from data-center IPs

Input

Lookup mode (default)

• ips: IPv4 or IPv6 addresses. You can paste raw log lines; every IP in a line is extracted. Duplicates are removed (up to 50,000 per run).
• providers (optional): limit which sources are loaded. Empty means all.

{ "mode": "lookup", "ips": ["52.94.236.248", "66.249.66.1", "Oct 15 sshd: Failed password from 34.102.136.180 port 22"] }

Export mode

• providers: which lists to export (empty means all)
• serviceFilter: keep ranges whose service or service tag contains this text (AzureStorage, EC2, Exchange, hooks, Googlebot)
• regionFilter: keep ranges whose region contains this text (us-east-1, westeurope, us-central1)
• ipVersion: both, 4 or 6
• maxRanges: upper limit on exported rows

{ "mode": "export", "providers": ["azure"], "serviceFilter": "AzureStorage", "regionFilter": "westus2", "ipVersion": "4" }

Output

Lookup mode, one row per IP:

{
  "ip": "66.249.66.1",
  "ipVersion": 4,
  "isKnownRange": true,
  "isPrivateOrReserved": false,
  "provider": "Google crawler",
  "category": "crawler",
  "providers": ["Google crawler", "Google"],
  "isCloud": false,
  "isCdn": false,
  "isSaas": true,
  "verifiedCrawler": "Google crawler: Googlebot",
  "services": ["Googlebot", "Google services"],
  "regions": [],
  "mostSpecificPrefix": "66.249.66.0/27",
  "matches": [{ "provider": "Google crawler", "service": "Googlebot", "prefix": "66.249.66.0/27", "source": "googlebot" }],
  "summary": "Google crawler + Google (Googlebot, Google services)"
}

Export mode, one row per range (provider, service, serviceTag, region, prefix, ipVersion, prefixLength, source). A de-duplicated plain list of CIDRs is also saved as ALLOWLIST.txt in the run's key-value store, so you can paste it straight into a firewall object or download it from a scheduled run.

Notes

• category is cloud, cdn, saas, crawler or reserved. The provider field is the most specific match; providers lists everything that contains the IP.
• Private, loopback, CGNAT, link-local, multicast and documentation ranges are flagged with isPrivateOrReserved instead of being reported as unknown.
• Some lists overlap on purpose. For example GitHub publishes the Azure ranges its Actions runners use, and Microsoft 365 ranges sit inside Azure's AzureCloud tag. Use matches to see every source.
• If a provider's list can't be downloaded, the run continues and that source is listed in sourcesNotLoaded and in the SOURCES record.
• Schedule the export mode weekly to keep allowlists current as providers add ranges.

Pricing

Pay per event:

• $2 per 1,000 IPs looked up ($0.002 each)
• $0.02 per 1,000 ranges exported

Related

• Microsoft 365 Tenant Finder: tenant ID, identity provider and mail provider for company domains.
• Bulk SPF / DMARC / MX Auditor: email-spoofing risk scores for domain lists.
• Free browser tools for admins: SysAdmin Toolbox.