Why identify cloud provider IPs?
When investigating suspicious network traffic, the first question is often "where is this traffic coming from?" Identifying whether an IP belongs to a major cloud provider like AWS, Azure, Google Cloud, or a CDN like Cloudflare is critical for incident response, threat assessment, and abuse reporting. Cloud-hosted attacks require different response procedures than attacks from residential ISPs. Tor exit node detection is equally important for understanding whether traffic is being anonymized.
How It Works
- Official IP Range Lists
- All major cloud providers publish their IP ranges as machine-readable JSON files. AWS publishes ip-ranges.json, Google Cloud publishes cloud.json, and Cloudflare publishes its ranges as plain text. This tool downloads these authoritative lists and performs local CIDR matching — no third-party lookups needed.
- CIDR Matching
- IP ranges are expressed in CIDR notation (e.g. 13.227.0.0/16 or 2606:4700::/32). The tool converts the target address and each range prefix to integers — 32-bit for IPv4, 128-bit for IPv6 — applies the prefix mask, and checks for a match. This runs entirely in your browser.
Updated 16 Oct 2026 — rewrote the FAQ answer on why cloud detection matters for OSINT to explain what a cloud, CDN or Tor match does and does not tell you.
☁️ Cloud IP Identifier — Frequently Asked Questions
How do I check which cloud provider an IP belongs to?
Enter an IP and the tool matches it against published cloud provider ranges — AWS, Google Cloud, Oracle Cloud, DigitalOcean, Linode, Cloudflare, Fastly, GitHub — and the Tor exit-relay list, telling you the provider, region or service, and whether it’s an anonymizing node.
Why identify cloud provider IPs?
Knowing which cloud provider hosts an IP is essential for incident response, firewall rules, abuse reporting, and infrastructure mapping. If a malicious IP belongs to AWS, you report abuse to AWS. If traffic comes from Cloudflare, the real origin IP is hidden behind their CDN. Cloud identification also helps verify if services are hosted where they claim to be.
Which cloud providers does the Cloud IP tool identify?
The tool checks IP addresses against the officially published range lists of AWS, Google Cloud, Oracle Cloud, DigitalOcean, Linode, Cloudflare, Fastly and GitHub, plus the Tor Project’s exit-relay list. Microsoft Azure is not matched because its Service Tags file is published under a URL that changes weekly; providers such as Vultr, Hetzner and OVH do not publish machine-readable range lists, so for those the IP Context card (ISP / organisation / ASN from WHOIS-derived data) is the indicator to use.
Does the Cloud IP tool support IPv6 addresses?
Yes. You can enter a full or compressed IPv6 address (for example 2606:4700::1111); it is matched against the IPv6 ranges that AWS, Google Cloud, Cloudflare, Fastly, GitHub, DigitalOcean and Linode publish, and against the IPv6 addresses of Tor exit relays. Oracle Cloud publishes IPv4 ranges only. An IPv4-mapped address such as ::ffff:13.227.100.50 is checked as the IPv4 address it contains.
Why is cloud provider detection useful for OSINT?
It stops you pinning an address on the wrong party. A cloud or CDN address is rented infrastructure: whoever runs the server is usually the provider’s customer, and the location is a data-centre region, not a home or office. A Tor exit match means the address belongs to a relay, not to whoever sent the traffic. The match names the provider, and often its region or service, so you know where to send an abuse report.
Read the guide: DNS recon and subdomains — how to map the hosts and infrastructure behind a domain.