Which AWS service uses this IP?

What the answer means

AWS publishes the address ranges it uses in a file called ip-ranges.json. Each range carries a service code and a region. The tool finds every published range that contains your address and explains the most specific one.

A named service, such as S3 or CloudFront

AWS uses the range for that service. Most codes mean the service answers on these addresses, for example S3, CloudFront edge servers or Route 53 name servers. A few codes mark traffic that comes from the service: API_GATEWAY, CLOUDFRONT_ORIGIN_FACING, ROUTE53_HEALTHCHECKS and EC2_INSTANCE_CONNECT. So an API_GATEWAY match doesn't mean an API is hosted at that address.

EC2 means EC2 address space, not necessarily an instance

EC2 ranges hold EC2 instances and many services built on EC2: Elastic IPs, load balancers, NAT gateways, outbound traffic from Lambda and Fargate, regional API Gateway endpoints and Lambda function URLs. AWS's data can't tell these apart. More about EC2 ranges

AMAZON means the service isn't disclosed

AMAZON is AWS's catch-all code: every published address is covered by an AMAZON entry, on its own range or a larger one. A range tagged only AMAZON is one AWS uses without saying for what. It could be infrastructure, AWS's own API endpoints, a service AWS doesn't list separately, or space not yet in use. When an AMAZON-only range sits inside a larger EC2 range, the tool says so separately. In tests for this site, AWS's regional API endpoints often sat in ranges like that, though AWS doesn't document it.

GLOBAL, Local Zones and Wavelength Zones

A region of GLOBAL means the range isn't tied to one region. It's typically used by CloudFront edge locations or Global Accelerator's anycast addresses, so no location is implied. A network border group such as us-east-1-iah-1 marks a Local Zone or Wavelength Zone, which can be in a different city, or even a different country, from its parent region. Regions and border groups explained

It never identifies the customer

A published range shows how AWS uses the addresses, never who its customer is, and AWS doesn't disclose customer information. What you can find out about an AWS address

“Not in the list” doesn't mean “not AWS”

Customers can bring their own address ranges to AWS (BYOIP), and some Amazon space isn't published at all, including most of the mail servers Amazon SES sends from. For an address that isn't listed, the tool can ask RIPEstat which network announces it, but only when you ask: click the button, or opt in to automatic checks.

How it works

Your browser downloads AWS's official ip-ranges.json directly from AWS and matches your query against it on your device. This site never receives what you look up: the query sits in the part of the address after the #, which browsers don't send to servers. Your browser keeps a copy of the data so return visits are quick, and checks AWS for a newer version each time.

Hostnames are resolved with DNS-over-HTTPS through Cloudflare's public resolver, with Google's as a fallback, so the resolver sees the hostname. Reverse DNS and the network-owner check run only when you ask for them, and each one says which service it contacts.

How it works in detail · Privacy

Questions

Can this tell me which company or person uses an AWS IP address?

No. AWS's data only says how AWS uses a range, and AWS doesn't disclose its customers. Reverse DNS and network lookups don't reveal them either. If an address is attacking you, report it to AWS, which can act on it. What you can find out

Why does it say “EC2 address space” and not “EC2 instance”?

Because EC2 ranges are shared by many services built on EC2, such as load balancers, NAT gateways and Lambda's outbound traffic. An address in EC2 space might belong to an instance, but AWS's data can't show that.

The address isn't in AWS's list. Is it definitely not AWS?

Not necessarily. Customers can bring their own addresses to AWS, and some Amazon services, such as SES mail servers, aren't in the file. Use “Check who announces this IP” on the result to see which network routes it. Other ways to check

Why do several ranges match one address?

AWS publishes nested ranges: a broader range with narrower ones inside it, such as a small range for one service carved out of a large EC2 block. One range can also carry several codes, for example S3 and EC2 together with the catch-all AMAZON. The narrowest range decides the answer, and the result table lists every match; for example, in September 2026, 3.0.5.33 or 44.248.100.1.

How current is the data?

As current as AWS's own file. Your browser downloads it from AWS, and the status line next to the answer shows when AWS published the copy you're using. AWS updates the file frequently and without a fixed schedule.

Is my lookup private?

Addresses are matched on your device and never sent to this site. Hostnames go to a public DNS-over-HTTPS resolver, and the optional reverse DNS and network checks send the address to the service named next to each button. There are no analytics scripts, cookies or trackers. Privacy details

How do I report abuse from an AWS IP address?

Use AWS's abuse report form or email trustandsafety@support.aws.com, with the address, exact times including the time zone, and the relevant log lines. Check first that the traffic is really unwanted: health checks, crawlers and CDN traffic are often expected. How to report AWS abuse