IP to AWS Service

Who owns this AWS IP address?

The network belongs to Amazon. The customer using an address at a given moment is something AWS won't tell you, and no lookup tool can either. Here is what you can find out, how to trace the address if it might be yours, and where to turn if it isn't.

An AWS IP range identifies AWS's use of the range, never the customer. Be wary of any tool or report that names a company from an AWS IP address alone.

Why AWS won't name the customer

AWS's Trust & Safety team shares information about a resource only with the permission of whoever controls it, and AWS's abuse FAQ says it doesn't disclose customer information. There are practical reasons too:

What you can learn

QuestionHow to find outHow far it gets you
Does AWS use this address?Look it up here or search ip-ranges.jsonReliable for published ranges
Which service and region?The same lookupOften just EC2 address space or service not disclosed
Which network announces it?An ASN lookupSeparates AWS, BYOIP and non-AWS space
Does it have a name?dig +short -x <ip>Usually a generic ec2-… name or nothing
Who runs the website or email involved?The domain name in the URL or message, not the IPPoints you to the site's operator and registrar

If the address might be in your own AWS account

If you run workloads on AWS, the "unknown" address may well be yours: a NAT gateway, a load balancer, a Lambda function's network interface. Public IPv4 addresses in a VPC are attached to network interfaces, so start there, in the region this site reports for the address.

IP=3.18.1.10
REGION=us-east-2

# Public IP on a network interface's primary private address
aws ec2 describe-network-interfaces --region "$REGION" \
  --filters Name=association.public-ip,Values="$IP" \
  --query 'NetworkInterfaces[].[NetworkInterfaceId,InterfaceType,Description,OwnerId]' \
  --output table

# Public IP on any of an interface's private addresses, including secondary ones
aws ec2 describe-network-interfaces --region "$REGION" \
  --filters Name=addresses.association.public-ip,Values="$IP" \
  --query 'NetworkInterfaces[].[NetworkInterfaceId,InterfaceType,Description,OwnerId]' \
  --output table

# Elastic IP addresses allocated to this account
aws ec2 describe-addresses --region "$REGION" --public-ips "$IP"

InterfaceType and Description usually name the service behind the interface; types include nat_gateway, load_balancer, network_load_balancer, lambda and vpc_endpoint. describe-addresses returns an error when the Elastic IP isn't in the account, which is itself an answer. Some interfaces that AWS services manage for you can be hidden from the default output; recent CLI versions accept --include-managed-resources to show them.

If the region is GLOBAL or you aren't sure, loop over every Region enabled in the account:

for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  aws ec2 describe-network-interfaces --region "$r" \
    --filters Name=association.public-ip,Values="$IP" \
    --query 'NetworkInterfaces[].[NetworkInterfaceId,InterfaceType,Description]' \
    --output text | sed "s/^/$r  /"
done

Across an organization, and over time

AWS walks through these options in How do I find the resource that owns an unknown IP address?

If it isn't yours

Common mistakes

Sources