X (Twitter) IP Ranges
X announces its traffic from AS13414, registered with ARIN to Twitter Inc. The company does publish addresses, in a few lines of a developer help page rather than in a file, and that published list has been narrower than the network for years.
- Provider
- X (Twitter)
- Primary ASN
- AS13414
- Category
- Tech
- Headquarters
- San Francisco, CA, USA
- Announced IPv4 prefixes
- 25
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS13414 (TWITTER - Twitter Inc.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
64.63.0.0/18
188.64.224.0/21
199.16.156.0/22
199.59.148.0/22
192.133.76.0/22
199.96.56.0/23
199.16.156.0/23
103.252.114.0/23
103.252.112.0/23
202.160.129.0/24
2a04:9d40:f000::/36
2606:1f80:f000::/36
2400:6680:f000::/36 (IPv6)
What does an X (Twitter) IP mean in a privacy test?
An X address in your logs is normally the crawler that builds the card preview when a link is posted, fetching the page and its image. It is not a visitor, and it is not somebody else's machine: AS13414 carries X's own services and none of it is leased out, so it is not a VPN or proxy exit. That is also why seeing an X address as your own visible IP in a privacy test would be unusual - there is nothing on that network for your traffic to leave through.
What X publishes, and where it falls short
The one place X states addresses is its Cards troubleshooting documentation. It names the user agent - Twitterbot, versioned, so Twitterbot/1.0 - gives the ASN as AS13414, and lists three blocks as X's aggregate outbound space: 199.16.156.0/22, 199.59.148.0/22 and 192.133.76.0/22. That is prose in a help page rather than a machine-readable feed; there is no X equivalent of GitHub's endpoint to poll for changes.
Those three /22s come to 3,072 addresses. AS13414 announces 25 IPv4 prefixes, and the largest of them is 64.63.0.0/18 - 16,384 addresses, registered with ARIN to Twitter Inc. since 13 February 2017 and absent from the published list. 188.64.224.0/21 is likewise announced and unlisted. A firewall rule copied from the documentation will therefore reject traffic that came from X's own network, and nothing in the documentation signals when that is happening.
Verifying Twitterbot when the published list is incomplete
A user-agent string is a header, so Twitterbot in a log line is a claim the sender made about itself and confirms nothing on its own. The address the connection arrived from is the part that has to be true, and the check that survives the network changing is the origin ASN rather than a copied set of CIDRs: an address announced by AS13414 is X, whether or not it appears in the help page's three blocks.
What that check cannot do is separate one X service from another. The registry does not break AS13414 down by function the way GitHub's published file does, so the same answer covers the card crawler, the API and the site itself, and anyone wanting to treat those differently has nothing published to work from. Nor does a match identify a person: X's network carries X's own services and nothing on it is rented to a customer, so there is no third-party machine to mistake for the operator.
Related tools
Frequently asked questions
What IP ranges does X (Twitter) use?
X announces 25 IPv4 prefixes and 3 IPv6 prefixes under AS13414, registered with ARIN to Twitter Inc. The largest are 64.63.0.0/18, 188.64.224.0/21 and 199.16.156.0/22. X's own documentation names only three blocks, so the routing table is the fuller record.
Why does an X IP appear in my privacy test?
An X address in your logs is normally the crawler that builds the card preview when a link is posted, fetching the page and its image. It is not a visitor, and it is not somebody else's machine: AS13414 carries X's own services and none of it is leased out, so it is not a VPN or proxy exit. That is also why seeing an X address as your own visible IP in a privacy test would be unusual - there is nothing on that network for your traffic to leave through.
Does X publish its crawler IP ranges?
Only partly, and only as prose. The Cards troubleshooting documentation names AS13414 and three blocks - 199.16.156.0/22, 199.59.148.0/22 and 192.133.76.0/22 - as X's aggregate outbound space. There is no machine-readable feed, and the routing table carries 25 IPv4 prefixes rather than three.
Which IP addresses does Twitterbot use?
More than the three blocks X documents. AS13414 also announces 64.63.0.0/18, registered with ARIN to Twitter Inc. since February 2017, and 188.64.224.0/21, neither of which appears in the published list. An allowlist copied from the documentation will drop traffic that came from X's own network.
How do I verify a request really came from Twitterbot?
The Twitterbot user agent is a header the caller sets, so it settles nothing by itself. Check the origin ASN of the address instead: AS13414, registered with ARIN to Twitter Inc. That check keeps working as X adds or retires prefixes, which a copied CIDR list does not.