# Cloud IP Range Lookup: AWS, Azure, GCP, Cloudflare, Bots (`sysadmin-toolbox/cloud-ip-range-lookup`) Actor

Find which cloud, CDN, SaaS or verified crawler owns any IP (AWS, Azure service tags, Google Cloud, Microsoft 365, Cloudflare, Fastly, GitHub, Googlebot, Bingbot, GPTBot...) with service and region. Or export official ranges as firewall allowlists.

- **URL**: https://apify.com/sysadmin-toolbox/cloud-ip-range-lookup.md
- **Developed by:** [SysAdmin Toolbox](https://apify.com/sysadmin-toolbox) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 ip checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Cloud IP Range Lookup: AWS, Azure, GCP, Cloudflare, Bots

Find out **who owns an IP address** in one run: AWS, Microsoft Azure, Google Cloud, Microsoft 365, Oracle Cloud, DigitalOcean, Cloudflare, Fastly, Bunny CDN, GitHub, Atlassian, or a **verified search or AI crawler** (Googlebot, Bingbot, GPTBot, ChatGPT-User, OAI-SearchBot). For every IP you get the provider, service (for example `EC2`, `AzureStorage`, `Exchange Online`, `actions`), region and the matching prefix.

Or flip it around: **export the official ranges** for any provider, service and region as clean CIDR rows and a plain-text allowlist, ready for a firewall, WAF, NSG, security group or proxy rule.

Every range is downloaded fresh at run time from each provider's **official published list** (AWS `ip-ranges.json`, Azure Service Tags, Google `cloud.json` / `goog.json`, the Microsoft 365 endpoints web service, Cloudflare, Fastly, GitHub `meta`, Atlassian, Google, Bing and OpenAI crawler lists). No API keys, no reverse DNS guesswork, no third-party IP database.

### Who it's for

- **Security and SOC analysts** triaging firewall, VPN, sign-in or web logs: is this traffic from a cloud VM, a CDN, Microsoft 365, GitHub Actions, or a real Googlebot?
- **SEO and web teams** separating verified Googlebot / Bingbot / GPTBot hits from fake crawlers spoofing the user agent
- **Network and cloud engineers** building allowlists: "all Azure Storage IPs in West US 2", "GitHub webhook IPs", "Exchange Online ranges", "AWS us-east-1 EC2"
- **Fraud and anti-abuse teams** flagging sign-ups and transactions coming from data-center IPs

### Input

**Lookup mode** (default)

- `ips`: IPv4 or IPv6 addresses. You can paste raw log lines; every IP in a line is extracted. Duplicates are removed (up to 50,000 per run).
- `providers` (optional): limit which sources are loaded. Empty means all.

```json
{ "mode": "lookup", "ips": ["52.94.236.248", "66.249.66.1", "Oct 15 sshd: Failed password from 34.102.136.180 port 22"] }
```

**Export mode**

- `providers`: which lists to export (empty means all)
- `serviceFilter`: keep ranges whose service or service tag contains this text (`AzureStorage`, `EC2`, `Exchange`, `hooks`, `Googlebot`)
- `regionFilter`: keep ranges whose region contains this text (`us-east-1`, `westeurope`, `us-central1`)
- `ipVersion`: `both`, `4` or `6`
- `maxRanges`: upper limit on exported rows

```json
{ "mode": "export", "providers": ["azure"], "serviceFilter": "AzureStorage", "regionFilter": "westus2", "ipVersion": "4" }
```

### Output

Lookup mode, one row per IP:

```json
{
  "ip": "66.249.66.1",
  "ipVersion": 4,
  "isKnownRange": true,
  "isPrivateOrReserved": false,
  "provider": "Google crawler",
  "category": "crawler",
  "providers": ["Google crawler", "Google"],
  "isCloud": false,
  "isCdn": false,
  "isSaas": true,
  "verifiedCrawler": "Google crawler: Googlebot",
  "services": ["Googlebot", "Google services"],
  "regions": [],
  "mostSpecificPrefix": "66.249.66.0/27",
  "matches": [{ "provider": "Google crawler", "service": "Googlebot", "prefix": "66.249.66.0/27", "source": "googlebot" }],
  "summary": "Google crawler + Google (Googlebot, Google services)"
}
```

Export mode, one row per range (`provider`, `service`, `serviceTag`, `region`, `prefix`, `ipVersion`, `prefixLength`, `source`). A de-duplicated plain list of CIDRs is also saved as **`ALLOWLIST.txt`** in the run's key-value store, so you can paste it straight into a firewall object or download it from a scheduled run.

#### Notes

- `category` is `cloud`, `cdn`, `saas`, `crawler` or `reserved`. The `provider` field is the most specific match; `providers` lists everything that contains the IP.
- Private, loopback, CGNAT, link-local, multicast and documentation ranges are flagged with `isPrivateOrReserved` instead of being reported as unknown.
- Some lists overlap on purpose. For example GitHub publishes the Azure ranges its Actions runners use, and Microsoft 365 ranges sit inside Azure's `AzureCloud` tag. Use `matches` to see every source.
- If a provider's list can't be downloaded, the run continues and that source is listed in `sourcesNotLoaded` and in the `SOURCES` record.
- Schedule the export mode weekly to keep allowlists current as providers add ranges.

### Pricing

Pay per event:

- **$2 per 1,000 IPs looked up** ($0.002 each)
- **$0.02 per 1,000 ranges exported**

### Related

- [Microsoft 365 Tenant Finder](https://apify.com/sysadmin-toolbox/m365-tenant-finder): tenant ID, identity provider and mail provider for company domains.
- [Bulk SPF / DMARC / MX Auditor](https://apify.com/sysadmin-toolbox/email-security-audit): email-spoofing risk scores for domain lists.
- Free browser tools for admins: [SysAdmin Toolbox](https://sysadmin-toolbox.pages.dev).

# Actor input Schema

## `mode` (type: `string`):

Look up who owns each IP, or export the official ranges for the selected providers as CIDR rows.

## `ips` (type: `array`):

Lookup mode. IPv4 or IPv6 addresses. You can paste whole log lines; every IP found in a line is checked. Duplicates removed (max 50,000).

## `providers` (type: `array`):

Sources to load. Leave empty for all.

## `serviceFilter` (type: `string`):

Export mode. Keep only ranges whose service or service tag contains this text, e.g. AzureStorage, EC2, Exchange Online, actions, Googlebot.

## `regionFilter` (type: `string`):

Export mode. Keep only ranges whose region contains this text, e.g. us-east-1, westeurope, us-central1.

## `ipVersion` (type: `string`):

Export mode.

## `maxRanges` (type: `integer`):

Export mode. Upper limit on rows exported.

## Actor input object example

```json
{
  "mode": "lookup",
  "ips": [
    "52.94.236.248",
    "20.190.128.1",
    "8.8.8.8",
    "104.16.132.229",
    "66.249.66.1",
    "140.82.112.3"
  ],
  "ipVersion": "both",
  "maxRanges": 100000
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `allowlist` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "ips": [
        "52.94.236.248",
        "20.190.128.1",
        "8.8.8.8",
        "104.16.132.229",
        "66.249.66.1",
        "140.82.112.3"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("sysadmin-toolbox/cloud-ip-range-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "ips": [
        "52.94.236.248",
        "20.190.128.1",
        "8.8.8.8",
        "104.16.132.229",
        "66.249.66.1",
        "140.82.112.3",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("sysadmin-toolbox/cloud-ip-range-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "ips": [
    "52.94.236.248",
    "20.190.128.1",
    "8.8.8.8",
    "104.16.132.229",
    "66.249.66.1",
    "140.82.112.3"
  ]
}' |
apify call sysadmin-toolbox/cloud-ip-range-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,sysadmin-toolbox/cloud-ip-range-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/F0M10AzoQVVfIWWMX/builds/94bqsd7j6eMOgJVP9/openapi.json