Dropbox IP Ranges
Dropbox runs its own network under AS19679, registered with ARIN to Dropbox, Inc. Its firewall guidance does not send you to that network, though: it asks you to allow domain names, because parts of the service run on other companies' addresses.
- Provider
- Dropbox
- Primary ASN
- AS19679
- Category
- Tech
- Headquarters
- San Francisco, CA, USA
- Announced IPv4 prefixes
- 41
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS19679 (DROPBOX - Dropbox, Inc.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
162.125.0.0/16
162.125.0.0/18
162.125.64.0/20
162.125.16.0/20
45.58.64.0/20
162.125.80.0/20
108.160.160.0/20
162.125.48.0/20
162.125.40.0/21
162.125.72.0/21
2620:100:6000::/40
2620:100:6010::/44
2620:100:6020::/44 (IPv6)
What does a Dropbox IP mean in a privacy test?
A Dropbox address in your logs is Dropbox's own infrastructure - the desktop client syncing, an API call or a shared-link fetch. It is not a hosting range and not somewhere a VPN exits from. What a match cannot do is rule Dropbox out, because parts of the service reach you from third-party addresses instead.
Dropbox does not publish a machine-readable IP list
This is the direct answer to the search that brings people here: there is no Dropbox equivalent of ip-ranges.amazonaws.com. Dropbox's firewall help page recommends allowing Dropbox domain names rather than addresses, and gives the reason plainly - alongside the addresses it owns, the service uses addresses belonging to third-party providers, so an address-based rule is incomplete by construction. For the addresses Dropbox does own, the page hands off to the registry and links the ARIN record for its organisation handle DROPB.
That leaves the registry as the checkable source, which is where the blocks above come from: the prefixes announced by AS19679 and registered to Dropbox, Inc. in ARIN. 162.125.0.0/16 is the block most Dropbox traffic comes out of, with 108.160.160.0/20, 45.58.64.0/20 and 185.45.8.0/22 alongside it. Read that as the list of what is certainly Dropbox, not as the list of everything Dropbox uses.
What an AS19679 address is, and what it is not
Dropbox's network carries Dropbox's own service and is not rented out, so there is no customer machine on it to confuse with the operator. That is the opposite of the situation on a cloud range, where an address tells you who owns the hardware and nothing about who is running software on it. An inbound connection from these blocks is Dropbox fetching or delivering something; an outbound connection to them is a client syncing.
The asymmetry worth keeping in mind is that a match proves Dropbox and a miss proves nothing. Because parts of the product ride on providers Dropbox does not own, traffic that genuinely belongs to the service can arrive from space registered to somebody else entirely - which is exactly why the company's own advice is to allow the names rather than the numbers.
Related tools
Frequently asked questions
What IP ranges does Dropbox use?
Dropbox announces its own space under AS19679, registered with ARIN to Dropbox, Inc.; 162.125.0.0/16 is the largest block, with 108.160.160.0/20, 45.58.64.0/20 and 185.45.8.0/22 alongside it. Dropbox does not publish a machine-readable list of these and points at the ARIN record for its DROPB organisation handle instead.
Why does a Dropbox IP appear in my privacy test?
A Dropbox address in your logs is Dropbox's own infrastructure - the desktop client syncing, an API call or a shared-link fetch. It is not a hosting range and not somewhere a VPN exits from. What a match cannot do is rule Dropbox out, because parts of the service reach you from third-party addresses instead.
Does Dropbox publish an IP allowlist?
No. Its firewall help page recommends allowing Dropbox domain names rather than IP addresses, because the service also uses addresses owned by third-party providers, and refers you to ARIN for the addresses Dropbox itself owns.
Can I firewall Dropbox by IP address?
You can allow or block the registry blocks announced by AS19679, and that covers the traffic arriving from Dropbox's own network. It will not cover the parts of the service running on third-party addresses, which is the gap Dropbox's own guidance is written around.
Is a Dropbox address a data centre address?
It is Dropbox's own infrastructure rather than rented compute. Nothing in AS19679 is leased to customers, so an address there is not a machine somebody else could be running a VPN or a proxy on.