Datacenter IP Address API

I maintain a public API to check whether an IP address belongs to a data center IP address range such as Azure, AWS, Digitalocean, Google Cloud Platform and many other cloud providers. Please read the full blog article for more a through introduction.

And please consider reading another blog article: "How to find out if an IP address belongs to a Hosting / Cloud Provider?" - Where I explain in detail about my approch of finding datacenter IP addresses.

The purpose of this API is simple: This API allows you to check whether an IP address belongs to an datacenter or not.

Live API

{
  "message": "Please make an API request",
}

Datacenter/Cloud IP API Key Features

• Always updated: The API database is automatically updated every day. Data is gathered from many sources: Self published IP ranges from large cloud providers, whois lookups and many other sources
• Pretty fast: The API is very performant. On average, an IP lookup takes 0.042ms (server side time consumed)
• Bulk IP Lookups: You can lookup up to 100 IP addresses per API call

ChangeLog

20th March 2022

• Improved API
• Remove the service attribute in API output. Only attribute that identifies the cloud provider is now datacenter
• Add bulk IP lookup mode. Allow up to 100 ips in bulk lookup mode. Only return datacenter IP addresses. Uses POST method. Ignore Invalid IPs

14th March 2022 and 15th March 2022

• Added 39,246 IPv4 and 360,372 IPv6 CIDR ranges ranges to the database from AFRINIC, RIPE-NCC, APNIC, ARIN and LACNIC whois databases.
• Some Examples: Lookup of Cloudflare IP, Lookup of M247 Ltd IP , Lookup of Packethub S.A. IP, Lookup of Leaseweb IP
• Added the following datacenters to the API: XT Global Networks LTD, OVH, myLoc, ServiHosting Networks S.L., Clouvider Limited, Hetzner Online, GoDaddy Operating Company, LLC., Claranet limited, Selectel Ltd., M247 Ltd, Imperva, Inc., Beget, trueserver.nl, 1&1 Internet, DediPath, iomart Hosting Ltd, Aruba S.p.a, Strato AG, DataCamp Limited, Rackspace, Inc., Reg.Ru Hosting, Heficed, LeaseWeb, Mittwald, The Constant Company, LLC, American Internet Services, Hostinger, PlusServer GmbH, Equinix, Inc., GHOSTnet GmbH, It7 Networks Inc, xservers.ro, Cloudflare, IBM Cloud, iWeb Technologies Inc., SysEleven SysEleven GmbH, G-Core Labs S.A., Tencent Cloud, Choopa, LLC., DigitalOcean, Webair Internet Development Inc, Hostway, Phoenix NAP, LLC, Contabo GmbH, A2 Hosting, Zenlayer, Optimate Server, LogicWeb Inc., Packethub S.A., MULTACOM Inc., veesp.com vps clients, Sakura Internet Inc., Zscaler, Inc., Vultr Holdings LLC, Enzu Inc., 24Shells Inc, GZ Systems (PureVPN), HIVELOCITY, Inc., Transip Bv., Host Europe, Internap Corporation, IP Exchange GmbH, Datapipe, Savvis, home.pl S.A., Redstation Limited, hosting.ua, Daou Technology, Linode, Amazon AWS, kinx.net, Dreamscape, Xneelo (Pty) Ltd, Fiber Grid Inc, Performive LLC, Microsoft Azure, UCloud, Hostgator, Hostwinds.com, Namecheap, Stackpath, LLC, ALL INKL, Online SAS (Scaleway), ServerCentral, Quadranet, Inc, FDC Servers, ColoCrossing, Aptum Technologies, Sharktech Inc., Wholesale Internet, Inc, Dreamhost, Pair Networks, ServerHub, Psychz Networks, CoreSpace,Inc., Cologix, Inc., Colocation America Inc, ServerMania Inc., Peak10, Google Cloud, Fasthosts Internet Ltd, latisys, Mullvad VPN, InMotion, Unified Layer, Fastly, Inc., Ubiquity Hosting.

11th March 2022

• Added bulk IP lookup mode, up to 100 IP addresses can be queried with one API request
• Added fast IPv6 lookup support (Speedup of factor 883x, average lookup time now 0.056ms instead of 49.99ms)

9th March 2022

• Added cidr attribute to the API output
• Improved API performance for IPv4 (IPv6 still pending), the performance is now 1500x times faster on average (Average lookup time before: 100.37ms, average lookup time now 0.068ms)

8th March 2022

• Added cloud service providers / hosting providers / VPN service providers: Linode, Mullvad VPN, B2 Net Solutions Inc., scaleway.com, Vultr Holdings, LLC, The Constant Company, LLC, QuadraNet Enterprises LLC, Zscaler, Inc., CloudCone, LLC, Psychz Networks, BuyVM Services (buyvm.net), DataCamp Limited, ColoCrossing, IT7 Networks Inc., G-Core Labs S.A., AlmaHost Ltd, Reg.Ru Hosting, Packethub S.A., Clouvider Limited, 24Shells Inc, Performive LLC, Packet Host, Inc., veesp.com vps clients, tzulo, inc., Cluster Logic Inc, Owl Limited, HIVELOCITY, Inc., SysEleven SysEleven GmbH
• Added lookup time in ms to the API output as attribute elapsed_ms
• Updated this API page
• Updated all IP address ranges

6th November 2021

• Updated all IP address ranges
• Add cloud provider m247 Ltd, servers.com Inc., Leaseweb Usa Inc., often used for proxies/fraud
• Checking for common datacenter in whois lookup

29th September 2021

• Updated all IP address ranges
• Added dedicated API endpoint: https://api.incolumitas.com/datacenter?ip=3.5.140.2
• Old API Endpoint: https://abs.incolumitas.com/datacenter?ip=1.2.3.4

API Usage Documentation

You can reach the API endpoint with this URL: https://api.incolumitas.com/datacenter?ip=

If you pass the IP address 3.5.140.2 to the API by calling https://api.incolumitas.com/datacenter?ip=3.5.140.2, you'll obtain the result:

{
  "ip": "3.5.140.2",
  "is_datacenter": true,
  "ip_data_source": "self_published_ip_ranges",
  "cidr": "3.5.140.0/22",
  "region": "ap-northeast-2",
  "datacenter": "Amazon AWS",
  "service": "AMAZON",
  "network_border_group": "ap-northeast-2",
  "other_matches": [
    {
      "ip_data_source": "self_published_ip_ranges",
      "cidr": "3.5.140.0/22",
      "region": "ap-northeast-2",
      "datacenter": "Amazon AWS",
      "service": "EC2",
      "network_border_group": "ap-northeast-2"
    }
  ],
  "elapsed_ms": 1.15
}

Alternatively, you can also lookup IPv6 addresses. Try the url https://api.incolumitas.com/datacenter?ip=2406:dafe:e0ff:ffff:ffff:ffff:dead:beef, which yields:

{
  "ip": "2406:dafe:e0ff:ffff:ffff:ffff:dead:beef",
  "is_datacenter": true,
  "ip_data_source": "self_published_ip_ranges",
  "cidr": "2406:dafe:e000::/40",
  "region": "ap-east-1",
  "datacenter": "Amazon AWS",
  "service": "AMAZON",
  "network_border_group": "ap-east-1",
  "elapsed_ms": 1.34
}

If you don't specify any IP address with the ip= query parameter and you invoke https://api.incolumitas.com/datacenter directly, the client's own IP address will be used for lookup. In my case, I get the following output:

{
  "ip": "84.157.228.82",
  "is_datacenter": false,
  "elapsed_ms": 0.28
}

because my private ISP IP address obviously doesn't belong to any datacenter.

Usage with JavaScript:

fetch('https://api.incolumitas.com/datacenter') 
  .then(response => response.json())
  .then(function(data) {
    console.log(data)
  })

The IP address ranges for the cloud providers are kept up to date and the IP ranges are pulled from the upstream sources every 4 hours.

Bulk IP Lookup

You can also lookup up to 100 IP addresses at once with a bulk API lookup mode.

For that, you will need to make a POST request. See this example with curl:

curl --header "Content-Type: application/json" \
  --request POST \
  --data '{"ips": ["162.158.0.0", "2406:dafe:e0ff:ffff:ffff:ffff:dead:beef", "162.88.0.0", "20.41.193.225"]}' \
  https://api.incolumitas.com/datacenter

The HTTP method needs to be POST and the API endpoint is the same: https://api.incolumitas.com/datacenter.

Only the IP addresses that have a match (is_datacenter equals true) will returned by the API. All other IP addresses will be omitted in order to save network bandwith. Duplicate IPs will be removed.

Example with JavaScript:

const ips = ["162.158.0.0", "2406:dafe:e0ff:ffff:ffff:ffff:dead:beef", "162.88.0.0", "20.41.193.225"];

fetch('https://api.incolumitas.com/datacenter', {
  method: 'POST',
  headers: {
    'Accept': 'application/json, text/plain, */*',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ips: ips})
}).then(res => res.json())
  .then(res => console.log(res));

More Examples for the IP Address Datacenter API

In the following section, I will show examples for looking up IP addresses belonging to the three biggest cloud providers AWS, Azure and GCP:

Looking up Azure IP Address

Looking up an Azure IP address: https://api.incolumitas.com/datacenter?ip=20.41.193.225

{
  "ip": "20.41.193.225",
  "is_datacenter": true,
  "ip_data_source": "self_published_ip_ranges",
  "cidr": "20.41.193.224/27",
  "name": "AzurePortal",
  "datacenter": "Microsoft Azure",
  "region": "",
  "regionId": 0,
  "platform": "Azure",
  "systemService": "AzurePortal",
  "other_matches": [
    {
      "datacenter": "Microsoft Azure",
      "asn": "8075",
      "cidr": "20.40.0.0/13",
      "ip_data_source": "whois_database"
    }
  ],
  "elapsed_ms": 16.2
}

Looking up AWS IP Address

Looking up an AWS IP address: https://api.incolumitas.com/datacenter?ip=3.5.140.2

{
  "ip": "3.5.140.2",
  "is_datacenter": true,
  "ip_data_source": "self_published_ip_ranges",
  "cidr": "3.5.140.0/22",
  "region": "ap-northeast-2",
  "datacenter": "Amazon AWS",
  "service": "AMAZON",
  "network_border_group": "ap-northeast-2",
  "other_matches": [
    {
      "ip_data_source": "self_published_ip_ranges",
      "cidr": "3.5.140.0/22",
      "region": "ap-northeast-2",
      "datacenter": "Amazon AWS",
      "service": "EC2",
      "network_border_group": "ap-northeast-2"
    }
  ],
  "elapsed_ms": 1.16
}

Looking up GCP IP Address

Looking up an GCP IP address: https://api.incolumitas.com/datacenter?ip=23.236.48.55

{
  "ip": "23.236.48.55",
  "is_datacenter": true,
  "datacenter": "Google Cloud",
  "asn": "15169",
  "cidr": "23.236.48.0/20",
  "ip_data_source": "whois_database",
  "other_matches": [
    {
      "ip_data_source": "self_published_ip_ranges",
      "cidr": "23.236.48.0/20",
      "datacenter": "Google Cloud"
    }
  ],
  "elapsed_ms": 27.27
}

Looking up AWS IPv6 Address

And looking up a AWS IPv6 address: https://api.incolumitas.com/datacenter?ip=2600:1F18:7FFF:F800:0000:ffff:0000:0000:

{
  "ip": "2600:1F18:7FFF:F800:0000:ffff:0000:0000",
  "is_datacenter": true,
  "ip_data_source": "self_published_ip_ranges",
  "cidr": "2600:1f18:7fff:f800::/56",
  "region": "us-east-1",
  "datacenter": "Amazon AWS",
  "service": "ROUTE53_HEALTHCHECKS",
  "network_border_group": "us-east-1",
  "elapsed_ms": 0.38
}

As you can see from the example lookups above, the API gives additional meta data information for a specific IP address such as regional and data center information.

Supported Datacenters / Cloud Services

Currently, the API supports IP address ranges from the following cloud providers:

The API database is updated every 4 hours with the official source of the IP address ranges of the cloud provides listed above (with a ✓). For some cloud providers such as OVH or Hetzner there is no official IP address range source, so I have to rely on third party sources.

Sources for Datacenter IP Address Ranges

Where do I get the CIDR address ranges for the datacenters?

Most datacenters publish their own IP ranges, such as AWS or Google Cloud. But often, those IP address ranges are not complete. For that reason, other means of lookup have to be used, such as whois lookups or searching through ASN databases.

This API follows the following lookup logic:

1. First, check if the IP is to be found in the published IP ranges from the providers.
2. If the first step farils, a lookup of the IP address with whois 105.226.177.72 is conducted. If the orgname belongs to a datacenter, we have a match. Simple string matching.
3. If the above whois lookup did not produce a datacenter match, we lookup the autonomous system OriginAS: AS21928 and we perform a simple grep cat ripe-asn.txt | grep -E -i "^13335\s" in the ASN lists to check if the ASN belongs to a large cloud provider.

Other techniques are pursuited, if the above algorithm doesn't yield a match.