Reference: AWS IP data
The details behind every answer on this site: what AWS's ip-ranges.json contains, what its service codes mean, how the lookup reaches its verdict, and where the data runs out.
The guides start from a question ("is this IP AWS?", "how do I report abuse?"). These pages start from the data.
AWS's published data
Service codes in ip-ranges.json
Every code in the file in plain English: AMAZON, EC2, CLOUDFRONT_ORIGIN_FACING and the rest, with the direction of traffic and what it means if the address contacts you.
The ip-ranges.json format
Fields, shared and nested ranges, how to choose the most specific match, partitions, update behaviour, change notifications and jq recipes.
What AWS's IP data can and can't tell you (2026)
A dated study: how much address space names a service, what's missing from the file, how often it changes and what reverse DNS adds.
About this site
How it works
Where the data comes from, what runs in your browser, how hostnames are resolved, the rule that picks the headline answer, and the blind spots.
Privacy
No cookies, analytics or ads. Which third parties see which requests, what your browser stores, and how to clear it.
About
Who built it, why, and how to report a wrong answer.
Key terms
- Prefix (CIDR range)
- A block of addresses such as
3.16.0.0/14. The number after the slash is the prefix length: the larger it is, the smaller and more specific the range. AMAZON- The catch-all service code. Every address in the file is covered by an
AMAZONentry; a range tagged onlyAMAZONmeans AWS uses it but doesn't say for what. More on AMAZON. EC2- EC2 address space. Instances use it, and so do load balancers, NAT gateways and many services built on EC2. It doesn't mean "an EC2 instance". More on EC2.
- Region and
GLOBAL - The AWS Region that advertises a range, such as
us-east-2.GLOBALranges can be used from many Regions at once, as CloudFront's edge servers are. - Network border group
- Where AWS advertises the range from: normally the Region itself, or a Local Zone (
us-west-2-lax-1) or Wavelength Zone (us-east-1-wl1-bos-wlz-1) in another city. syncTokenandcreateDate- The version of the file: its publication time as Unix epoch seconds, and the same time as
YYYY-MM-DD-HH-MM-SSin UTC. - Most specific range
- When several ranges contain an address, the smallest one (the longest prefix) gives the headline answer. How the rule works.
- Not listed
- The address isn't in AWS's published ranges. On its own, that doesn't rule out AWS: customer-owned ranges brought to AWS and some Amazon services are left out of the file.