DigitalOcean IP Ranges

Known IP ranges

The blocks below are the major address allocations associated with DigitalOcean. A network of this size deaggregates heavily, so an individual route in the global routing table is usually more specific than the block shown. Prefix sets change over time — use WHOIS Lookup for the authoritative current record for any specific IP.

45.55.0.0/16
104.131.0.0/16
159.89.0.0/16
167.99.0.0/16
206.189.0.0/16
138.68.0.0/16

What does a DigitalOcean IP mean in a privacy test?

A DigitalOcean IP as your exit almost certainly means your VPN provider hosts that server on DigitalOcean Droplets. DigitalOcean is one of the most commonly used hosting providers for commercial VPN exit nodes.

Where DigitalOcean publishes its ranges

DigitalOcean does not publish a service-by-service JSON the way AWS and Azure do, because it has no comparable set of first-party services to separate out. What it does publish is an RFC 8805 geolocation feed at https://www.digitalocean.com/geo/google.csv: one line per CIDR with country, subdivision, city and postal code, in the form 24.144.80.0/20,US,US-CA,Santa Clara,95054. It covers IPv4 and IPv6, and it is the file that states which data centre a block of Droplet addresses physically sits in — which is more than the WHOIS record will tell you.

For the routing view rather than the geography, the authoritative source is the registry record for AS14061. A geofeed exists because routing data carries no location at all, so when a commercial geolocation database and this file disagree about where a DigitalOcean range is, the file is the operator's own statement and the database is an inference.

Every public DigitalOcean address is somebody's Droplet

DigitalOcean sells compute rather than services, so there is no equivalent of Amazon's CLOUDFRONT subset or Azure's AzureFrontDoor tag to check against. With few exceptions a public AS14061 address is a virtual machine a customer rented, and DigitalOcean is not the party sending the traffic. That is the honest reading of one in an access log: a machine in a data centre, rented by someone the registry does not name, doing what its renter told it to. It is not a home connection, and the match on its own does not separate a VPN exit from a crawler, a monitoring probe or a small production site.

Two DigitalOcean address types sit outside that. A Reserved IP is a public address a customer can detach from one Droplet and attach to another, so the same address can front a different machine tomorrow — an address history describes the range, not the tenant. And the private VPC interface a Droplet also holds is not reachable from the internet and will never be the address a website sees, which is what searches for a private DigitalOcean IP are usually running into.

Related tools

Frequently asked questions