Apple IP Ranges
Apple runs its own network under AS714, registered with ARIN to Apple Inc., and nearly all of it sits inside 17.0.0.0/8 - a full /8 that ARIN has recorded against Apple since April 1990. Apple publishes two address lists, and neither one lists the addresses Apple users browse from.
- Provider
- Apple
- Primary ASN
- AS714
- Category
- Tech
- Headquarters
- Cupertino, CA, USA
- Announced IPv4 prefixes
- 1542
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS714 (APPLE-ENGINEERING - Apple Inc.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
17.0.0.0/8
17.128.0.0/9
17.0.0.0/9
17.160.0.0/12
17.168.0.0/13
17.180.0.0/14
17.168.0.0/14
17.114.0.0/15
17.104.0.0/15
17.190.0.0/15
2403:300::/32
2a01:b747::/32
2620:149::/32 (IPv6)
What does an Apple IP mean in a privacy test?
An Apple address in your logs is Apple reaching out rather than a visitor arriving: that space carries Apple's own services and its crawler, and none of it is leased to anyone else, so it is not somewhere a VPN or proxy exits from. The reverse case is the one that matters in a privacy test. With iCloud Private Relay on, the address a site records is not an Apple address at all - Apple sends the second hop through a partner network, so a lookup returns that partner instead.
The two lists Apple publishes, and what each one covers
Apple publishes no general allowlist. There is no Apple equivalent of ip-ranges.amazonaws.com covering iCloud, the App Store and Apple Music together. What Apple does publish is two narrow files, and they answer opposite questions.
The first is search.developer.apple.com/applebot.json, the address list for Apple's crawler. It is a small JSON object with two keys: a creationTime stamp and a prefixes array. When this page was checked the stamp read 2026-07-31 and the array held 33 IPv4 prefixes, all inside 17.x and mostly /24s and /27s. A routing lookup on one of them, 17.241.208.160/27, returns AS714, so Applebot runs on Apple's own space rather than on rented capacity. There are no IPv6 entries in the file.
The second is mask-api.icloud.com/egress-ip-ranges.csv, which Apple links from its network-preparation guidance under the heading about geolocation feeds. It lists the addresses iCloud Private Relay traffic leaves from, and Apple notes that most data providers annotate those addresses with an Organization field reading iCloud Private Relay, which is how a server recognises one. It is far larger than the crawler list, and as the next section explains, the addresses in it are not Apple's.
Why an iCloud Private Relay visitor is not a 17.x address
Apple describes Private Relay as a multi-hop design in which a request travels through two separate relays operated by different entities, so that no single party - Apple included - sees both who is asking and what they asked for. The first hop is Apple's. The second, the one your server actually sees, is run by a contracted partner, and Cloudflare has published its own account of operating that egress role.
The consequence is what trips people up. A visitor on Private Relay does not appear from AS714, and a WHOIS or ASN lookup on their address returns the partner network rather than Apple. That is precisely why Apple publishes the egress ranges as a separate file: they cannot be derived from Apple's registry records, because they are not Apple's addresses.
Read the other way round, an address in 17.0.0.0/8 announced by AS714 is Apple's own infrastructure, and that much is solid. What it does not tell you is which part of Apple. The registry does not break the /8 down by service, and the crawler's slice is the only one published separately, so an unlisted 17.x address is an Apple system of some kind and the record stops there.
Related tools
Frequently asked questions
What IP ranges does Apple use?
Apple announces 1,542 IPv4 prefixes and 441 IPv6 prefixes under AS714, registered with ARIN to Apple Inc. Almost all of the IPv4 space is carved out of 17.0.0.0/8, a block ARIN has recorded against Apple since April 1990. The only per-service breakdown Apple publishes is the crawler list at search.developer.apple.com/applebot.json.
Why does an Apple IP appear in my privacy test?
An Apple address in your logs is Apple reaching out rather than a visitor arriving: that space carries Apple's own services and its crawler, and none of it is leased to anyone else, so it is not somewhere a VPN or proxy exits from. The reverse case is the one that matters in a privacy test. With iCloud Private Relay on, the address a site records is not an Apple address at all - Apple sends the second hop through a partner network, so a lookup returns that partner instead.
Does Apple publish a list of its IP ranges?
Two partial ones, and no general allowlist. search.developer.apple.com/applebot.json carries the crawler's prefixes - 33 IPv4 entries, all inside 17.x, when this page was checked. mask-api.icloud.com/egress-ip-ranges.csv carries the addresses iCloud Private Relay traffic leaves from. Nothing published covers iCloud, the App Store or Apple Music as a whole.
Is an iCloud Private Relay address an Apple IP address?
No. Apple routes Private Relay through two relays operated by different entities, and the second one - the address your server logs - belongs to a contracted partner rather than to Apple. That is why Apple publishes those ranges in a separate file: a lookup on one returns the partner network, not AS714.
Why is a 17.x address hitting my web server?
Most often Applebot fetching a page, or an Apple service calling an API. What it is not is a person browsing from behind an Apple address: AS714 carries Apple's own systems and is not rented out, so nothing on it is a customer machine. If the address is in applebot.json it is the crawler; if it is not, the published records do not say which service it belongs to.