Zscaler IP Ranges
Zscaler runs a security cloud that traffic is routed through, rather than a network that hosts servers for other people. Its enforcement nodes answer from AS22616, registered with ARIN to Zscaler, Inc. in 2014, with AS53813 and AS62907 carrying further space.
- Provider
- Zscaler
- Primary ASN
- AS22616
- Category
- Security
- Headquarters
- San Jose, CA, USA
- Announced IPv4 prefixes
- 523
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS22616 (ZSCALER-SJC1 - ZSCALER, INC.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
164.137.0.0/16
170.85.0.0/16
159.254.0.0/16
220.42.0.0/16
220.43.0.0/16
167.106.0.0/16
136.226.0.0/16
137.31.0.0/16
165.225.0.0/17
147.161.128.0/17
2605:4300:2a00::/40
2605:4300:1b00::/40
2605:4300:1200::/40 (IPv6)
What does a Zscaler IP mean in a privacy test?
A Zscaler address as your visible IP means your traffic left through a Zscaler enforcement node rather than through your own line, which is the normal result on a managed work device. The address belongs to the security cloud an organisation subscribes to, it is shared by everyone routed through the same node, and it geolocates to that data centre rather than to the person using it.
Where Zscaler publishes its enforcement node ranges
Zscaler publishes the ranges under the name Cloud Enforcement Node Ranges at config.zscaler.com, and there is one set per cloud rather than one list for the company: zscaler.net, zscalerone.net, zscalertwo.net, zscalerthree.net and zscloud.net each publish their own. The machine-readable form is JSON, at config.zscaler.com/api/<cloud>/cenr/json.
The file is nested cloud, then continent, then data centre - EMEA holds entries such as Amsterdam II and Frankfurt IV, Americas holds Atlanta II and New York III - and each entry carries more than a prefix. Alongside range there is a vpn and a gre endpoint where one exists, a hostname, and a latitude and longitude. That structure is what lets you answer which Zscaler data centre an address sits in, which the registry record on its own cannot tell you. The list that applies to an organisation is the one for the cloud its tenant is on, not the union of all five.
What a Zscaler address says about the machine behind it
Zscaler's position in the path is the reverse of a hosting provider's. A cloud or VPS address is a machine somebody rented and can run anything on; a Zscaler address is a node other people's traffic passes through on its way out to the internet. So an AS22616 address in a website's logs is a visitor whose employer routes them through Zscaler, and the same address will appear for every one of that employer's users assigned to the same node.
That is also why an address here is a poor identifier for one person and a good identifier for one facility. The published feed maps each range to a named data centre with coordinates, so a leak test reporting a city the reader has never been to is usually reporting the enforcement node rather than making a mistake. It says nothing about which organisation is behind the traffic: one node serves many tenants and the ranges are shared between them.
Related tools
Frequently asked questions
What IP ranges does Zscaler use?
Zscaler announces addresses under AS22616, with AS53813 and AS62907 carrying further space, all registered with ARIN to Zscaler, Inc. The blocks above are the largest currently routed on AS22616. The authoritative operational list is the Cloud Enforcement Node Ranges Zscaler publishes at config.zscaler.com, one set per cloud.
Why does a Zscaler IP appear in my privacy test?
A Zscaler address as your visible IP means your traffic left through a Zscaler enforcement node rather than through your own line, which is the normal result on a managed work device. The address belongs to the security cloud an organisation subscribes to, it is shared by everyone routed through the same node, and it geolocates to that data centre rather than to the person using it.
Which Zscaler IP list applies to my organisation?
The one for the cloud your tenant is on. Zscaler publishes separate range sets for zscaler.net, zscalerone.net, zscalertwo.net, zscalerthree.net and zscloud.net, each available as JSON at config.zscaler.com/api/<cloud>/cenr/json, so allowlisting the wrong one leaves the traffic you care about outside the rule.
Why does my IP geolocate to a city I have never visited?
Because the address belongs to the Zscaler enforcement node your traffic left through rather than to you. Each published range carries a data centre name and a latitude and longitude, so the location a lookup reports is that facility.
Is a Zscaler address a VPN exit?
It is a proxy exit, but not a consumer VPN. The address belongs to a corporate security service the device was configured to use, usually by an employer, and it is shared with every other user routed through the same enforcement node.