Meta (Facebook) IP Ranges
Meta announces Facebook, Instagram and WhatsApp traffic from AS32934, registered with ARIN to Facebook, Inc. It is not Meta's only network in the routing table: AS63293 and AS54115 are announced under the same registrant, and an allowlist built from AS32934 alone will not match everything Meta sends.
- Provider
- Meta (Facebook)
- Primary ASN
- AS32934
- Category
- Tech
- Headquarters
- Menlo Park, CA, USA
- Announced IPv4 prefixes
- 234
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS32934 (FACEBOOK - Facebook, Inc.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
57.144.0.0/14
129.134.0.0/17
163.70.128.0/17
157.240.0.0/17
31.13.64.0/18
157.240.192.0/18
173.252.96.0/19
31.13.96.0/19
69.171.224.0/19
173.252.64.0/19
2a03:2880::/32
2a03:2880:1000::/36
2a03:2880::/36 (IPv6)
What does a Meta (Facebook) IP mean in a privacy test?
A Meta address arriving at your server is usually a fetch rather than a person - the crawler that builds the link preview when somebody shares your URL, or one of the other agents Meta runs for ads and indexing. Meta names those by user agent and publishes no addresses for them, which leaves the origin ASN as the only part of the request the sender cannot choose. Seeing a Meta address as your own visible IP is a different matter: this space carries Meta's services and is not leased to anyone, so it is not a VPN or proxy exit.
Meta publishes user agents, not addresses
Meta's web-crawlers documentation is the page site owners are sent to, and what it contains is a list of five user-agent strings with no addresses beside them: facebookexternalhit/1.1, meta-webindexer/1.1, meta-externalads/1.1, meta-externalagent/1.1 and meta-externalfetcher/1.1. The page tells you to allow either the user agents or the addresses the crawler uses, and then does not publish the addresses. There is no ip-ranges.json and no endpoint to poll.
That leaves the routing registry, which is public and can be queried directly. The conventional form is an IRR lookup for the routes registered against the ASN - whois -h whois.radb.net -- -i origin AS32934 - and the same query against AS63293 and AS54115 returns the rest of Meta's space. This is a routing-registry convention rather than something Meta documents, and it inherits that registry's limit: it reports what has been registered, which can lag what is actually announced. Comparing it against a live BGP view is the way to see the difference.
Three Meta ASNs, and what a match on one proves
All three are registered with ARIN to Facebook, Inc., and they carry different things. AS32934, holder name FACEBOOK, is the main network: 234 IPv4 prefixes and 325 IPv6 prefixes, including 57.144.0.0/14, 129.134.0.0/17, 163.70.128.0/17 and 157.240.0.0/17. AS63293, holder name FACEBOOK-OFFNET, announced 169 prefixes when this page was built and is the off-net edge - cache capacity placed close to users in networks where Meta has no primary deployment. AS54115, holder name FACEBOOK-CORP, is a much smaller 23 prefixes and is corporate rather than product space.
A match on any of the three establishes that the address is Meta infrastructure. It does not establish which product the request came from, because none of the three is broken down by service the way GitHub's published file is, and it does not identify a person: Meta's networks carry Meta's own services and none of that space is rented to customers, so there is no third-party machine on it to confuse with the operator. The check is worth running in the other direction too. A request calling itself facebookexternalhit from an address outside all three ASNs is not Meta, and the user-agent string on its own would never have told you.
Related tools
Frequently asked questions
What IP ranges does Meta use?
Meta announces 234 IPv4 prefixes and 325 IPv6 prefixes under AS32934, registered with ARIN to Facebook, Inc.; 57.144.0.0/14, 129.134.0.0/17 and 157.240.0.0/17 are among the largest. Two further ASNs carry Meta space: AS63293, the off-net edge, with 169 prefixes, and AS54115, corporate, with 23.
Why does a Meta IP appear in my privacy test?
A Meta address arriving at your server is usually a fetch rather than a person - the crawler that builds the link preview when somebody shares your URL, or one of the other agents Meta runs for ads and indexing. Meta names those by user agent and publishes no addresses for them, which leaves the origin ASN as the only part of the request the sender cannot choose. Seeing a Meta address as your own visible IP is a different matter: this space carries Meta's services and is not leased to anyone, so it is not a VPN or proxy exit.
Does Meta publish a list of crawler IP addresses?
No. Its web-crawlers documentation names five user agents - facebookexternalhit, meta-webindexer, meta-externalads, meta-externalagent and meta-externalfetcher - and gives no addresses for any of them. There is no published file and no endpoint to poll, which leaves the routing registry as the only source.
How do I check that a request really came from facebookexternalhit?
The user agent is a header the caller sets, so on its own it proves nothing. The part that has to be true is the address the connection arrived from: check whether it is announced by AS32934, AS63293 or AS54115, all three registered with ARIN to Facebook, Inc.
Are there Meta IP ranges outside AS32934?
Yes. AS63293, holder name FACEBOOK-OFFNET, announced 169 prefixes when this page was built, and AS54115, FACEBOOK-CORP, announced 23. Both are registered to Facebook, Inc. A firewall rule derived from AS32934 alone misses them.