A public GitHub repository titled cloud-provider-ip-addresses is making it easier for system administrators to find and apply the IP address ranges used by major cloud platforms, content delivery networks and web crawlers. The project publishes daily-updated IP ranges for 67 providers in more than 13 output formats, including files designed to be loaded directly into web servers and firewalls. As of its latest update on 13 October 2026, the dataset listed 451,779 CIDR blocks covering 459,450,004 IPv4 addresses, which the repository states is 10.70% of the IPv4 space.
What the dataset covers
The repository tracks a broad mix of organisations. Among the best-known names are Amazon Web Services, Microsoft Azure, Google Cloud Platform, Cloudflare, GitHub, Fastly and Linode, along with crawlers such as GoogleBot, BingBot and GPTBot. The providers are grouped into several categories in the project's supported-providers list:
- Cloud providers, such as AWS, Azure and Google Cloud Platform
- CDN and hosting services, such as Cloudflare and Fastly
- SaaS and collaboration tools, including Atlassian and Zoom
- CI/CD and monitoring services, such as CircleCI, Datadog and Pingdom
- Bots and crawlers, including GoogleBot, BingBot and GPTBot
- VPN and anonymizer networks, such as the Tor Project's exit node list and Mullvad VPN's relay list
Some entities publish no official IP range feed at all. For these, the repository derives ranges from live BGP announcements of their registered autonomous system numbers, using public BGP data sources. The source notes that these derived networks cover all address space an entity originates, not only its cloud or customer ranges, and that they may miss space routed through partner networks. Readers should keep that limitation in mind when using those lists for security decisions.
Formats built for firewalls and servers
Each provider is available in a range of formats. The repository lists TXT, JSON, CSV and SQL for data analysis, alongside configuration-ready outputs for Nginx, Apache, iptables, nftables, UFW, HAProxy and Caddy. For providers with service and region data, such as AWS, Azure and GCP, the formats are also generated for each individual service and region.
Large lists present a practical problem. A separate iptables or UFW rule for every range becomes unmanageable when a provider has thousands of blocks. The project addresses this with an ipset format, which loads an entire set into a kernel hash table that a single firewall rule can match. The repository also notes that ipset belongs to the iptables era, so nftables users are pointed to a separate configuration file that uses native nftables sets.
Merged CIDRs and change detection
Adjacent and overlapping blocks are collapsed into the smallest possible list using Python's ipaddress.collapse_addresses() function. Separate merged files are provided for IPv4, IPv6 and both combined, which suits firewall rules where compactness matters.
To avoid unnecessary reloads, each provider ships a metadata file with a version number. The version increases only when the IP set actually changes, so administrators can poll it rather than comparing full lists every time. The metadata also includes a content checksum and per-family address counts.
Daily updates, releases and changelog
According to the repository, all data updates daily at 02:00 UTC. Files are also served through the jsDelivr content delivery network, which the project offers as a faster alternative to GitHub's raw file URLs. Users can follow the latest data using the main branch reference, or pin a dated release for reproducible downloads. The project states that its update workflow purges the jsDelivr cache for key files on every push, so the main branch reference refreshes within minutes.
Each daily run also publishes a GitHub release tagged with the date, bundling the full dataset with SHA-256 checksums. A changelog records CIDRs added or removed per provider, and machine-readable daily diffs are stored alongside it. A statistics file and a summary file report per-provider counts and the share of IPv4 space covered, which lets analysts track how cloud address space changes over time.
Companion tools and client libraries
The project's companion tool, ip-watch, applies the ranges to a live server. The source describes it as a single static Go binary that works with seven engines, four for the web server layer (nginx, Caddy, Apache and HAProxy) and three for the firewall layer (nftables, iptables and ufw). It can run in allow or deny mode, pre-validates changes with each engine's native checker, and rolls back automatically if validation or reload fails.
For developers who prefer code to raw files, the repository also offers Go and JavaScript client libraries for IP detection. These currently cover six major cloud providers: AWS, GCP, Azure, Cloudflare, DigitalOcean and Oracle Cloud. The full dataset remains available only as raw files, so teams that need the other providers will need to work with those files directly.
Practical uses for administrators
The repository lists a wide set of use cases. Among the most common are:
- Allowing traffic only from known cloud provider addresses
- Blocking AI crawlers such as GPTBot, or allowing search crawlers such as GoogleBot and BingBot
- Whitelisting upstream CDN addresses from Cloudflare or Fastly in a web application firewall
- Allowing only GitHub Actions addresses to trigger deployments
- Identifying whether a suspicious IP address belongs to cloud infrastructure
The project is dedicated to the public domain under the CC0 1.0 Universal license, so organisations can reuse the data without restriction. Its acknowledgments credit each provider for publishing the underlying information openly.
With daily updates, checksum-verified releases and ready-made configuration files, the repository gives administrators a practical starting point for managing cloud-linked traffic. Its value will depend on how consistently providers keep their own feeds current, and on users checking the repository's documented limitations, especially for networks derived from BGP data.
Related: Talorys: Open-Source Personal AI Agent Runs in Your Cloudflare Account · Open-Source n8n Bot Calculates Czech Tax on Broker Investments
Comments (0)