GitHub IP Ranges
GitHub publishes its own address list at api.github.com/meta, split by what each range is for, and that file is the most useful answer to almost every question that brings people to this page. GitHub's own network is small - AS36459 announces 24 IPv4 prefixes - and most of what the file lists is not on it.
- Provider
- GitHub
- Primary ASN
- AS36459
- Category
- Tech
- Headquarters
- San Francisco, CA, USA
- Announced IPv4 prefixes
- 24
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS36459 (GITHUB - GitHub, Inc.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
140.82.112.0/20
143.55.64.0/20
192.30.252.0/22
192.30.254.0/23
140.82.120.0/23
192.30.252.0/23
140.82.112.0/24
140.82.124.0/24
192.30.254.0/24
192.30.252.0/24
2a0a:a440::/29
2620:112:3000::/44 (IPv6)
What does a GitHub IP mean in a privacy test?
A GitHub address in your logs is GitHub calling you: a webhook delivery, a Pages fetch, an Actions runner reaching your API. Which of those it is, the published file will tell you, because it separates the ranges by function. Seeing a GitHub address as your own visible IP is a different thing - AS36459 runs GitHub's services rather than anyone else's machines, so it is not somewhere a tunnel exits from. Actions runners are the exception worth knowing about, and they do not use a GitHub address at all.
api.github.com/meta, and how to read it
A plain GET to api.github.com/meta returns a JSON object whose keys name a purpose rather than a network. hooks holds the addresses webhook deliveries come from and is short - six entries when this page was checked: 192.30.252.0/22, 185.199.108.0/22, 140.82.112.0/20, 143.55.64.0/20 and two IPv6 blocks. web, api and git run to a few dozen entries each. pages is a handful of individual /32 and /128 addresses rather than blocks. packages, importer and github_enterprise_importer are similarly small. actions is the outlier, past five hundred entries. The same object also carries ssh_key_fingerprints and verifiable_password_authentication, which is that endpoint's other job.
GitHub attaches two warnings, and both change how the file should be used. It is not intended to be exhaustive - GitHub names Git LFS and Packages as services whose addresses may be missing from it - and the addresses change from time to time, with regular monitoring of the endpoint recommended rather than a one-off copy into a firewall rule.
The published list spans three different networks
What the file does not say, and a routing lookup does, is that those ranges are not all GitHub's. Checked against the routing table: 140.82.112.0/20 and 192.30.252.0/22 are announced by AS36459, GitHub's own network. 185.199.108.0/22 - the block behind GitHub Pages, and also present in the hooks list - is announced by AS54113, which is Fastly. The actions ranges are Microsoft's: 4.148.0.0/16, one of the first entries in that array, sits inside the 4.144.0.0/12 announced by AS8075. GitHub's own documentation matches that last one, describing hosted runners as using dynamically assigned addresses from shared infrastructure.
Two things follow. An allowlist built from AS36459 - the natural move if you start from a page about IP ranges rather than from the file - admits webhooks and blocks GitHub Pages and every Actions runner. And the reverse check is weaker than it looks: an address appearing in the published file is not proof of GitHub, because the Fastly and Azure ranges it names are shared with every other tenant on that infrastructure. For webhook deliveries GitHub offers something stronger than a source address - it signs each delivery with an HMAC carried in the X-Hub-Signature-256 header, and its documentation asks that the signature be validated before the payload is processed.
Related tools
Frequently asked questions
What IP ranges does GitHub use?
GitHub's own network, AS36459, is registered with ARIN to GitHub, Inc. and announces 24 IPv4 prefixes and 2 IPv6 prefixes; 140.82.112.0/20 and 143.55.64.0/20 are the largest. That is not the list to build a firewall from, though - api.github.com/meta covers considerably more address space than AS36459 announces.
Why does a GitHub IP appear in my privacy test?
A GitHub address in your logs is GitHub calling you: a webhook delivery, a Pages fetch, an Actions runner reaching your API. Which of those it is, the published file will tell you, because it separates the ranges by function. Seeing a GitHub address as your own visible IP is a different thing - AS36459 runs GitHub's services rather than anyone else's machines, so it is not somewhere a tunnel exits from. Actions runners are the exception worth knowing about, and they do not use a GitHub address at all.
Where does GitHub publish its IP ranges?
At api.github.com/meta, as JSON keyed by service: hooks, web, api, git, packages, pages, importer, github_enterprise_importer and actions. GitHub says the list is not intended to be exhaustive - Git LFS and Packages may be missing from it - and that the addresses change from time to time, so the endpoint is meant to be re-read rather than copied once.
Are GitHub Actions runners on GitHub's IP ranges?
No. GitHub describes hosted runners as using dynamically assigned addresses from shared infrastructure, published under the actions key. Those ranges are Microsoft's: 4.148.0.0/16, one of the first entries, sits inside the 4.144.0.0/12 announced by AS8075 rather than by GitHub's AS36459.
Which addresses do GitHub webhooks come from?
The hooks key of api.github.com/meta, six entries when this page was checked. Not all of them are GitHub's own space - 185.199.108.0/22 in that list is announced by Fastly's AS54113 - so a source-address rule is a weak check on its own. GitHub signs each delivery with an HMAC in the X-Hub-Signature-256 header and asks that it be validated before the payload is processed.