Cloudflare IP Ranges

Known IP ranges

The blocks below are the major address allocations associated with Cloudflare. A network of this size deaggregates heavily, so an individual route in the global routing table is usually more specific than the block shown. Prefix sets change over time — use WHOIS Lookup for the authoritative current record for any specific IP.

104.16.0.0/12
172.64.0.0/13
162.158.0.0/15
198.41.128.0/17
188.114.96.0/20
104.24.0.0/14

What does a Cloudflare IP mean in a privacy test?

A Cloudflare IP in a privacy or VPN test typically means your browsing traffic routes through the Cloudflare CDN, you are using the 1.1.1.1 DNS resolver, or your VPN provider uses Cloudflare infrastructure for its network layer.

Where Cloudflare publishes its IP list

Cloudflare keeps the current set at https://www.cloudflare.com/ips-v4/ and https://www.cloudflare.com/ips-v6/ as plain text, one CIDR per line, and behind https://api.cloudflare.com/client/v4/ips as JSON. The API response carries ipv4_cidrs, ipv6_cidrs and an etag that Cloudflare documents as a digest of the IP data, so comparing the etag against your last copy tells you whether anything changed without diffing the list itself.

That published list is far shorter than the number of prefixes AS13335 announces overall, and the difference matters: it covers the proxy ranges that reach customer origins, not everything Cloudflare routes. It also moves rarely — cloudflare.com/ips carries its own dated change history going back years — which is why allowlisting it at an origin is practical, and why a match against it is a much narrower fact than a match against an AWS or Azure range.

A Cloudflare address is a proxy, not an origin

Every address on that list is a Cloudflare machine sitting in front of somebody else's website, which is why a Cloudflare IP in a server log is almost never the visitor. Cloudflare's documented answer is the CF-Connecting-IP header, which carries the address of the client that connected to Cloudflare; Cloudflare recommends reading it, or True-Client-IP, in preference to X-Forwarded-For, which can arrive with several comma-separated addresses appended by intermediate proxies.

Two consequences follow for anyone reading a lookup. A website whose address resolves into AS13335 tells you nothing about where that site is hosted — the origin sits behind the proxy, and the range is shared with every other Cloudflare customer. And a DNS test that names Cloudflare is usually 1.1.1.1 or 1.0.0.1 answering your lookups, which is the resolver you are using rather than the exit address a site sees. A Cloudflare match identifies the network in the middle, not either end.

Related tools

Frequently asked questions