Find the AWS region of an IP address

Every range in AWS's published list carries a region and a network border group. Together they say where AWS uses an address, at the level AWS is willing to share: a region such as us-east-2, sometimes narrowed to a Local Zone or Wavelength Zone. They never give a building or a street, and for GLOBAL ranges they deliberately give no location at all.

Examples, with what they returned when this guide was written: 3.18.1.10 is in US East (Ohio), 15.220.120.1 is in a Buenos Aires Local Zone attached to us-east-1, 155.146.0.1 is in AWS's Boston Wavelength Zone, which AWS's geolocation feed places in Westborough, Massachusetts, and 13.32.12.39 is GLOBAL (CloudFront).

Region and network border group

Each row in ip-ranges.json has two location fields:

For ordinary regional ranges the two values are the same. They differ when a range lives in a Local Zone or Wavelength Zone. Then region is the parent Region, which handles control-plane work such as API calls, and the border group says where the addresses are actually used. An Elastic IP address can only be used in the border group it was allocated in, so the border group tells you where an address can be used. AWS can still reassign whole ranges: 108.166.224.0/21 moved from us-west-2 to GLOBAL in September 2026.

Local Zones

Local Zones are small AWS sites close to users in a city. Their border groups are named after the parent Region plus a location code, usually an airport code: us-west-2-lax-1 is Los Angeles, us-east-1-bos-1 Boston, us-east-1-iah-1 Houston. The parent Region can be far away, even in another country: us-east-1-bue-1 is Buenos Aires, us-east-1-lim-1 Lima and us-east-1-scl-1 Santiago, all attached to N. Virginia.

That is why placing a Local Zone address in Virginia is wrong. AWS publishes a separate geolocation feed in the standard RFC 8805 format that accounts for Local Zones:

curl -s https://ip-ranges.amazonaws.com/geo-ip-feed.csv | grep -F '15.220.120.0/21,'
15.220.120.0/21,AR,AR-B,Buenos Aires,

Wavelength Zones

Wavelength Zones sit inside telecom carriers' 5G networks. Their border groups look like us-east-1-wl1-bos-wlz-1: parent Region, a wl segment, a city code, then wlz. Not every name follows the pattern exactly, so treat it as a hint and check AWS's Wavelength locations or Local Zones list when it matters.

With an AWS account you can list every zone and its border group for a Region:

aws ec2 describe-availability-zones --region us-east-1 --all-availability-zones \
  --query 'AvailabilityZones[].[ZoneName,ZoneType,NetworkBorderGroup]' --output table

What GLOBAL means

AWS uses GLOBAL when traffic for a range can arrive at, or come from, many Regions, up to all of them. In practice these are mostly edge and anycast services: CloudFront, Route 53 name servers, Global Accelerator's static addresses, and some S3 and EC2 ranges. A GLOBAL answer tells you the service, not the place. Which site handles a given connection depends on where the traffic comes from.

Two wrinkles:

• Regional ranges inside global ones. Some regional ranges are nested inside a larger GLOBAL block. When we checked, 64.252.81.1 matched an EC2 range in sa-east-1 inside a global CloudFront block. This site shows both rows so the nesting is visible.
• Global ranges with a real region. Route 53 health checkers in 15.177.0.0/18 are listed as GLOBAL, yet each checker runs in a specific Region, and reverse DNS shows which (next section).

Decoding reverse DNS names

Reverse DNS (a PTR record) often carries the region for EC2 address space:

dig +short -x 15.177.10.1
ec2-15-177-10-1.us-west-1.compute.amazonaws.com.

That address is a Route 53 health checker: GLOBAL in the file, US West (N. California) in DNS. Keep the limits in mind:

• An ec2-… name is the default for EC2 address space. Load balancers, NAT gateways, regional API Gateway endpoints and AWS's own API endpoints get the same kind of name, so it doesn't prove an instance, and it never names the customer.
• Many AWS addresses have no PTR record, and IPv6 addresses almost never have one.
• In our tests, the region in the name always matched the published region, so for regional ranges it adds little. It is most useful for GLOBAL ranges.

"I found ec2-….compute-1.amazonaws.com in netstat. Is it malware?" Not by itself. It means your computer talked to something hosted in AWS's N. Virginia region, as a large share of websites and apps are. Look at which program opened the connection (lsof -i on macOS and Linux, netstat -b as administrator on Windows), not at the hostname.

Region codes in the current data

This table is built from the current ip-ranges.json when you ask for it; nothing downloads until you click. It lists every region code in the file with its name, network border groups and prefix counts. The file mixes AWS partitions, so China (cn-), GovCloud (us-gov-) and European Sovereign Cloud (eusc-) codes appear alongside commercial Regions. A few codes have no published name yet and are shown as-is.

From the command line

List every region and border group pair in the file:

jq -r '[.prefixes[], .ipv6_prefixes[] | [.region, .network_border_group]] | unique[] | @tsv' ip-ranges.json

To get the region of one address, use the jq or Python snippets in the guide to checking an IP: the third and fourth columns are the region and border group.

Related guides

• How to check if an IP address belongs to AWS
• CloudFront IP ranges and the real client IP
• How to allowlist AWS IP ranges

Sources

• AWS: Syntax for AWS IP address range JSON (region, network border group, GLOBAL)
• AWS: AWS Local Zones concepts
• AWS: AWS IP address ranges (geolocation feed)
• AWS: EC2 instance hostnames and domains
• AWS: IP address ranges of Amazon Route 53 servers