IP Intelligence - ngrok documentation

IP Intelligence provides you with additional information about any IP address you see in ngrok. It includes Autonomous System information, Geolocation data, as well as information fetched from 3rd parties that list IP address for blocklists or allowlists. See the full list of IP Categories available here. These variables can be used in Traffic Policy expressions, or they can be used to enrich your traffic via dynamic injection into headers or responses.

Client IP Intelligence

The following variables are available under the conn.client_ip namespace:

Name	Type	Description
`conn.client_ip.categories`	`list`	The list of categories that classify the `conn.client_ip`. Check out our full list of categories.
`conn.client_ip.is_on_blocklist`	`boolean`	`true` when the `conn.client_ip` appears on one of the curated IP reputation blocklists ngrok trusts. Convenience shortcut for blocklist checks against `conn.client_ip.categories`.
`conn.client_ip.is_tor_node`	`boolean`	`true` when the `conn.client_ip` is a known Tor exit node. Equivalent to checking for `proxy.anonymous.tor` in `conn.client_ip.categories`.

`conn.client_ip.categories`

The list of categories that classify the conn.client_ip. Check out our full list of categories.

expressions:
  - "('proxy.anonymous.tor' in conn.client_ip.categories)"

{
  "expressions": [
    "('proxy.anonymous.tor' in conn.client_ip.categories)"
  ]
}

`conn.client_ip.is_on_blocklist`

true when the conn.client_ip appears on one of the curated IP reputation blocklists ngrok trusts. These are blocklists with low false-positive rates, suitable for blocking traffic on the critical path. This is a convenience shortcut equivalent to checking conn.client_ip.categories for any blocklist category.

expressions:
  - "conn.client_ip.is_on_blocklist == true"

{
  "expressions": [
    "conn.client_ip.is_on_blocklist == true"
  ]
}

`conn.client_ip.is_tor_node`

true when the conn.client_ip is a known Tor exit node. This is a convenience shortcut equivalent to checking 'proxy.anonymous.tor' in conn.client_ip.categories.

expressions:
  - "conn.client_ip.is_tor_node == true"

{
  "expressions": [
    "conn.client_ip.is_tor_node == true"
  ]
}

Client IP Autonomous System

The following variables are available under the conn.client_ip namespace:

Name	Type	Description
`conn.client_ip.as.number`	`integer`	The Autonomous System Number of the `conn.client_ip`.
`conn.client_ip.as.organization`	`string`	The Autonomous System Organization name of the `conn.client_ip`.

`conn.client_ip.as.number`

The Autonomous System Number of the conn.client_ip.

expressions:
  - "conn.client_ip.as.number == 12345"

{
  "expressions": [
    "conn.client_ip.as.number == 12345"
  ]
}

`conn.client_ip.as.organization`

The Autonomous System Organization name of the conn.client_ip.

expressions:
  - "conn.client_ip.as.organization == 'COMCAST-7922'"

{
  "expressions": [
    "conn.client_ip.as.organization == 'COMCAST-7922'"
  ]
}

Client IP Geo Location

This is the location where the IP address is located, which may be different from where the IP address is registered. For more details, see the MaxMind documentation.

Name	Type	Description
`conn.client_ip.geo.location.city`	`string`	The name of the city, in EN, where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.continent`	`string`	The name of the continent, in EN, where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.country`	`string`	The name of the country, in EN, where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.country_code`	`string`	The two-letter ISO country code where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.is_eu`	`boolean`	Determines if the `conn.client_ip` is located in the EU. Helpful for GDPR compliance.
`conn.client_ip.geo.location.latitude`	`string`	The approximate latitude where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.longitude`	`string`	The approximate longitude where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.metro_code`	`string`	The metro code where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.postal_code`	`string`	The postal code where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.radius`	`string`	The radius in kilometers around the latitude and longitude where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.subdivision`	`string`	The name of the subdivision, in EN, where the `conn.client_ip` is likely to originate.
`conn.client_ip.geo.location.timezone`	`string`	The name of the timezone where the `conn.client_ip` is likely to originate.

`conn.client_ip.geo.location.city`

The name of the city, in EN, where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.city == 'Strongsville'"

{
  "expressions": [
    "conn.client_ip.geo.location.city == 'Strongsville'"
  ]
}

`conn.client_ip.geo.location.continent`

The name of the continent, in EN, where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.continent == 'North America'"

{
  "expressions": [
    "conn.client_ip.geo.location.continent == 'North America'"
  ]
}

`conn.client_ip.geo.location.country`

The name of the country, in EN, where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.country == 'United States'"

{
  "expressions": [
    "conn.client_ip.geo.location.country == 'United States'"
  ]
}

`conn.client_ip.geo.location.country_code`

The two-letter ISO country code where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.country_code != 'US'"

{
  "expressions": [
    "conn.client_ip.geo.location.country_code != 'US'"
  ]
}

`conn.client_ip.geo.location.is_eu`

Determines if the conn.client_ip is in the EU. Helpful for GDPR compliance.

expressions:
  - "conn.client_ip.geo.location.is_eu == true"

{
  "expressions": [
    "conn.client_ip.geo.location.is_eu == true"
  ]
}

`conn.client_ip.geo.location.latitude`

The approximate latitude where the conn.client_ip is likely to originate.

expressions:
  - "double(conn.client_ip.geo.location.latitude) >= 45.0"

{
  "expressions": [
    "double(conn.client_ip.geo.location.latitude) >= 45.0"
  ]
}

`conn.client_ip.geo.location.longitude`

The approximate longitude where the conn.client_ip is likely to originate.

expressions:
  - "double(conn.client_ip.geo.location.longitude) <= -93.0"

{
  "expressions": [
    "double(conn.client_ip.geo.location.longitude) <= -93.0"
  ]
}

`conn.client_ip.geo.location.metro_code`

The metro code where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.metro_code != ''"

{
  "expressions": [
    "conn.client_ip.geo.location.metro_code != ''"
  ]
}

`conn.client_ip.geo.location.postal_code`

The postal code where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.postal_code == '94324'"

{
  "expressions": [
    "conn.client_ip.geo.location.postal_code == '94324'"
  ]
}

`conn.client_ip.geo.location.radius`

The radius in kilometers around the latitude and longitude where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.radius <= '5'"

{
  "expressions": [
    "conn.client_ip.geo.location.radius <= '5'"
  ]
}

`conn.client_ip.geo.location.subdivision`

The name of the subdivision, in EN, where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.subdivision == 'California'"

{
  "expressions": [
    "conn.client_ip.geo.location.subdivision == 'California'"
  ]
}

`conn.client_ip.geo.location.timezone`

The name of the timezone where the conn.client_ip is likely to originate.

expressions:
  - "conn.client_ip.geo.location.timezone == 'America/New_York'"

{
  "expressions": [
    "conn.client_ip.geo.location.timezone == 'America/New_York'"
  ]
}

Client IP Registered Geo Location

This is the location where the IP address is registered, which may be different from where the IP address is located. For more details, see the MaxMind documentation.

Name	Type	Description
`conn.client_ip.geo.registered_location.city`	`string`	The name of the city, in EN, where the `conn.client_ip` is registered.
`conn.client_ip.geo.registered_location.continent`	`string`	The name of the continent, in EN, where the `conn.client_ip` is registered.
`conn.client_ip.geo.registered_location.country`	`string`	The name of the country, in EN, where the `conn.client_ip` is registered.
`conn.client_ip.geo.registered_location.country_code`	`string`	The two-letter ISO country code where the `conn.client_ip` is registered.
`conn.client_ip.geo.registered_location.is_eu`	`boolean`	Determines if the `conn.client_ip` is registered in the EU. Helpful for GDPR compliance.
`conn.client_ip.geo.registered_location.metro_code`	`string`	The metro code where the `conn.client_ip` is registered.
`conn.client_ip.geo.registered_location.subdivision`	`string`	The name of the subdivision, in EN, where the `conn.client_ip` is registered.
`conn.client_ip.geo.registered_location.timezone`	`string`	The name of the timezone where the `conn.client_ip` is registered.

`conn.client_ip.geo.registered_location.city`

The name of the city, in EN, where the conn.client_ip is registered.

expressions:
  - "conn.client_ip.geo.registered_location.city == 'Strongsville'"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.city == 'Strongsville'"
  ]
}

`conn.client_ip.geo.registered_location.continent`

The name of the continent, in EN, where the conn.client_ip is registered.

expressions:
  - "conn.client_ip.geo.registered_location.continent == 'North America'"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.continent == 'North America'"
  ]
}

`conn.client_ip.geo.registered_location.country`

The name of the country, in EN, where the conn.client_ip is registered.

expressions:
  - "conn.client_ip.geo.registered_location.country == 'United States'"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.country == 'United States'"
  ]
}

`conn.client_ip.geo.registered_location.country_code`

The two-letter ISO country code where the conn.client_ip is registered.

expressions:
  - "conn.client_ip.geo.registered_location.country_code != 'US'"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.country_code != 'US'"
  ]
}

`conn.client_ip.geo.registered_location.is_eu`

Determines if the conn.client_ip is in the EU. Helpful for GDPR compliance.

expressions:
  - "conn.client_ip.geo.registered_location.is_eu == true"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.is_eu == true"
  ]
}

`conn.client_ip.geo.registered_location.subdivision`

The name of the subdivision, in EN, where the conn.client_ip is registered.

expressions:
  - "conn.client_ip.geo.registered_location.subdivision == 'California'"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.subdivision == 'California'"
  ]
}

`conn.client_ip.geo.registered_location.metro_code`

The metro code where the conn.client_ip is registered.

expressions:
  - "conn.client_ip.geo.registered_location.metro_code != ''"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.metro_code != ''"
  ]
}

`conn.client_ip.geo.registered_location.timezone`

The name of the timezone where the conn.client_ip is registered.

expressions:
  - "conn.client_ip.geo.registered_location.timezone == 'America/New_York'"

{
  "expressions": [
    "conn.client_ip.geo.registered_location.timezone == 'America/New_York'"
  ]
}

Server IP Intelligence

The following variables are available under the conn.server_ip namespace:

Name	Type	Description
`conn.server_ip.categories`	`list`	The list of categories that classify the `conn.server_ip`. Check out our full list of categories.
`conn.server_ip.is_on_blocklist`	`boolean`	`true` when the `conn.server_ip` appears on one of the curated IP reputation blocklists ngrok trusts. Convenience shortcut for blocklist checks against `conn.server_ip.categories`.
`conn.server_ip.is_tor_node`	`boolean`	`true` when the `conn.server_ip` is a known Tor exit node. Equivalent to checking for `proxy.anonymous.tor` in `conn.server_ip.categories`.

`conn.server_ip.categories`

The list of categories that classify the conn.server_ip. Check out our full list of categories.

expressions:
  - "('proxy.anonymous.tor' in conn.server_ip.categories)"

{
  "expressions": [
    "('proxy.anonymous.tor' in conn.server_ip.categories)"
  ]
}

`conn.server_ip.is_on_blocklist`

true when the conn.server_ip appears on one of the curated IP reputation blocklists ngrok trusts. These are blocklists with low false-positive rates, suitable for blocking traffic on the critical path. This is a convenience shortcut equivalent to checking conn.server_ip.categories for any blocklist category.

expressions:
  - "conn.server_ip.is_on_blocklist == true"

{
  "expressions": [
    "conn.server_ip.is_on_blocklist == true"
  ]
}

`conn.server_ip.is_tor_node`

true when the conn.server_ip is a known Tor exit node. This is a convenience shortcut equivalent to checking 'proxy.anonymous.tor' in conn.server_ip.categories.

expressions:
  - "conn.server_ip.is_tor_node == true"

{
  "expressions": [
    "conn.server_ip.is_tor_node == true"
  ]
}

Server IP Autonomous System

Name	Type	Description
`conn.server_ip.as.number`	`integer`	The Autonomous System Number of the `conn.server_ip`.
`conn.server_ip.as.organization`	`string`	The Autonomous System Organization name of the `conn.server_ip`.

`conn.server_ip.as.number`

The Autonomous System Number of the conn.server_ip.

expressions:
  - "conn.server_ip.as.number == 12345"

{
  "expressions": [
    "conn.server_ip.as.number == 12345"
  ]
}

`conn.server_ip.as.organization`

The Autonomous System Organization name of the conn.server_ip.

expressions:
  - "conn.server_ip.as.organization == 'COMCAST-7922'"

{
  "expressions": [
    "conn.server_ip.as.organization == 'COMCAST-7922'"
  ]
}

Server IP Location Geo

This is the location where the server IP address is located, which may be different from where the IP address is registered. For more details, see the MaxMind documentation.

Name	Type	Description
`conn.server_ip.geo.location.city`	`string`	The name of the city, in EN, where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.continent`	`string`	The name of the continent, in EN, where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.country`	`string`	The name of the country, in EN, where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.country_code`	`string`	The two-letter ISO country code where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.is_eu`	`boolean`	Determines if the `conn.server_ip` is located in the EU. Helpful for GDPR compliance.
`conn.server_ip.geo.location.latitude`	`string`	The approximate latitude where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.longitude`	`string`	The approximate longitude where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.metro_code`	`string`	The metro code where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.postal_code`	`string`	The postal code where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.radius`	`string`	The radius in kilometers around the latitude and longitude where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.subdivision`	`string`	The name of the subdivision, in EN, where the `conn.server_ip` is likely to originate.
`conn.server_ip.geo.location.timezone`	`string`	The name of the timezone where the `conn.server_ip` is likely to originate.

`conn.server_ip.geo.location.city`

The name of the city, in EN, where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.city == 'Strongsville'"

{
  "expressions": [
    "conn.server_ip.geo.location.city == 'Strongsville'"
  ]
}

`conn.server_ip.geo.location.continent`

The name of the continent, in EN, where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.continent == 'North America'"

{
  "expressions": [
    "conn.server_ip.geo.location.continent == 'North America'"
  ]
}

`conn.server_ip.geo.location.country`

The name of the country, in EN, where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.country == 'United States'"

{
  "expressions": [
    "conn.server_ip.geo.location.country == 'United States'"
  ]
}

`conn.server_ip.geo.location.country_code`

The two-letter ISO country code where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.country_code != 'US'"

{
  "expressions": [
    "conn.server_ip.geo.location.country_code != 'US'"
  ]
}

`conn.server_ip.geo.location.is_eu`

Determines if the conn.server_ip location is in the EU. Helpful for GDPR compliance.

expressions:
  - "conn.server_ip.geo.location.is_eu == true"

{
  "expressions": [
    "conn.server_ip.geo.location.is_eu == true"
  ]
}

`conn.server_ip.geo.location.latitude`

The approximate latitude where the conn.server_ip is likely to originate.

expressions:
  - "double(conn.server_ip.geo.location.latitude) >= 45.0"

{
  "expressions": [
    "double(conn.server_ip.geo.location.latitude) >= 45.0"
  ]
}

`conn.server_ip.geo.location.longitude`

The approximate longitude where the conn.server_ip is likely to originate.

expressions:
  - "double(conn.server_ip.geo.location.longitude) <= -93.0"

{
  "expressions": [
    "double(conn.server_ip.geo.location.longitude) <= -93.0"
  ]
}

`conn.server_ip.geo.location.metro_code`

The metro code where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.metro_code != ''"

{
  "expressions": [
    "conn.server_ip.geo.location.metro_code != ''"
  ]
}

`conn.server_ip.geo.location.postal_code`

The postal code where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.postal_code == '94324'"

{
  "expressions": [
    "conn.server_ip.geo.location.postal_code == '94324'"
  ]
}

`conn.server_ip.geo.location.radius`

The radius in kilometers around the latitude and longitude where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.radius <= '5'"

{
  "expressions": [
    "conn.server_ip.geo.location.radius <= '5'"
  ]
}

`conn.server_ip.geo.location.subdivision`

The name of the subdivision, in EN, where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.subdivision == 'California'"

{
  "expressions": [
    "conn.server_ip.geo.location.subdivision == 'California'"
  ]
}

`conn.server_ip.geo.location.timezone`

The name of the timezone where the conn.server_ip is likely to originate.

expressions:
  - "conn.server_ip.geo.location.timezone == 'America/New_York'"

{
  "expressions": [
    "conn.server_ip.geo.location.timezone == 'America/New_York'"
  ]
}

Server IP Registered Location Geo

This is the location where the server IP address is registered, which may be different from where the IP address is located. For more details, see the MaxMind documentation.

Name	Type	Description
`conn.server_ip.geo.registered_location.city`	`string`	The name of the city, in EN, where the `conn.server_ip` is registered.
`conn.server_ip.geo.registered_location.continent`	`string`	The name of the continent, in EN, where the `conn.server_ip` is registered.
`conn.server_ip.geo.registered_location.country`	`string`	The name of the country, in EN, where the `conn.server_ip` is registered.
`conn.server_ip.geo.registered_location.country_code`	`string`	The two-letter ISO country code where the `conn.server_ip` is registered.
`conn.server_ip.geo.registered_location.is_eu`	`boolean`	Determines if the `conn.server_ip` is registered in the EU. Helpful for GDPR compliance.
`conn.server_ip.geo.registered_location.metro_code`	`string`	The metro code where the `conn.server_ip` is registered.
`conn.server_ip.geo.registered_location.subdivision`	`string`	The name of the subdivision, in EN, where the `conn.server_ip` is registered.
`conn.server_ip.geo.registered_location.timezone`	`string`	The name of the timezone where the `conn.server_ip` is registered.

`conn.server_ip.geo.registered_location.city`

The name of the city, in EN, where the conn.server_ip is registered.

expressions:
  - "conn.server_ip.geo.registered_location.city == 'Strongsville'"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.city == 'Strongsville'"
  ]
}

`conn.server_ip.geo.registered_location.continent`

The name of the continent, in EN, where the conn.server_ip is registered.

expressions:
  - "conn.server_ip.geo.registered_location.continent == 'North America'"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.continent == 'North America'"
  ]
}

`conn.server_ip.geo.registered_location.country`

The name of the country, in EN, where the conn.server_ip is registered.

expressions:
  - "conn.server_ip.geo.registered_location.country == 'United States'"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.country == 'United States'"
  ]
}

`conn.server_ip.geo.registered_location.country_code`

The two-letter ISO country code where the conn.server_ip is registered.

expressions:
  - "conn.server_ip.geo.registered_location.country_code != 'US'"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.country_code != 'US'"
  ]
}

`conn.server_ip.geo.registered_location.is_eu`

Determines if the conn.server_ip is in the EU. Helpful for GDPR compliance.

expressions:
  - "conn.server_ip.geo.registered_location.is_eu == true"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.is_eu == true"
  ]
}

`conn.server_ip.geo.registered_location.subdivision`

The name of the subdivision, in EN, where the conn.server_ip is registered.

expressions:
  - "conn.server_ip.geo.registered_location.subdivision == 'California'"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.subdivision == 'California'"
  ]
}

`conn.server_ip.geo.registered_location.metro_code`

The metro code where the conn.server_ip is registered.

expressions:
  - "conn.server_ip.geo.registered_location.metro_code != ''"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.metro_code != ''"
  ]
}

`conn.server_ip.geo.registered_location.timezone`

The name of the timezone where the conn.server_ip is registered.

expressions:
  - "conn.server_ip.geo.registered_location.timezone == 'America/New_York'"

{
  "expressions": [
    "conn.server_ip.geo.registered_location.timezone == 'America/New_York'"
  ]
}

IP Categories

The following categories are available to use with the IP Intelligence .categories list. The categories are hierarchal and can be matched at any level needed. For example, an IP with the category of com.cloudflare.ipv4 also has the categories com and com.cloudflare. This can be helpful if you want to allow all IPs from Cloudflare using com.cloudflare which would have both ipv4 and ipv6 lists. Here’s an example of how to block Tor exit node IPs from accessing your endpoint.

expressions:
  - "('proxy.anonymous.tor' in conn.client_ip.categories)"

{
  "expressions": [
    "('proxy.anonymous.tor' in conn.client_ip.categories)"
  ]
}

Or you can block all anonymous proxies which would include Tor as well as any other lists with the proxy.anonymous category.

expressions:
  - "('proxy.anonymous' in conn.client_ip.categories)"

{
  "expressions": [
    "('proxy.anonymous' in conn.client_ip.categories)"
  ]
}

Blocklists

Name	Description	Sources
`blocklist.greensnow_co`	From greensnow.co: GreenSnow is a team consisting of the best specialists in computer security, we harvest a large number of IPs from different computers located around the world. GreenSnow is comparable with Spamhaus for attacks of any kind except for spam. Our list is updated automatically and you can withdraw at any time your IP address if it has been listed.	Source
`blocklist.stopforumspam`	From stopforumspam.com: The data provided here represents what we believe will only ever be used to abuse. IP Addresses listed here will be returned in API results as “blacklisted”. You would be very unlikely to see valid content from the IP addresses listed.	Source
`blocklist.com.cinsscore.army`	From cinsscore.com: The CINS Army list is a subset of the CINS Active Threat Intelligence ruleset, and consists of IP addresses that meet one of two basic criteria: 1. The IP’s recent Rogue Packet score factor is very poor, or 2. The IP has tripped a designated number of ‘trusted’ alerts across a given number of our Sentinels deployed around the world.	Source
`blocklist.blocklist_de`	From BlockList.de: All IP addresses that have attacked one of our customers/servers in the last 48 hours.	Source
`blocklist.blocklist_de.apache`	From BlockList.de: All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache, Apache-DDOS, RFI-Attacks.	Source
`blocklist.blocklist_de.bots`	From BlockList.de: All IP addresses which have been reported within the last 48 hours as having run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots (BadBots = he has posted a Spam-Comment on a open Forum or Wiki).	Source
`blocklist.blocklist_de.bruteforcelogin`	From BlockList.de: All IPs which attacks Joomlas, Wordpress and other Web-Logins with Brute-Force Logins.	Source
`blocklist.blocklist_de.ftp`	From BlockList.de: All IP addresses which have been reported within the last 48 hours for attacks on the Service FTP.	Source
`blocklist.blocklist_de.imap`	From BlockList.de: All IP addresses which have been reported within the last 48 hours for attacks on the Service imap, sasl, pop3.	Source
`blocklist.blocklist_de.mail`	From BlockList.de: All IP addresses which have been reported within the last 48 hours as having run attacks on the service Mail, Postfix.	Source
`blocklist.blocklist_de.sip`	From BlockList.de: All IP addresses that tried to login in a SIP-, VOIP- or Asterisk-Server and are included in the IPs-List from http://www.infiltrated.net/ (Twitter).	Source
`blocklist.blocklist_de.strongips`	From BlockList.de: All IPs which are older then 2 month and have more than 5,000 attacks.	Source
`blocklist.blocklist_de.ssh`	From BlockList.de: All IP addresses which have been reported within the last 48 hours as having run attacks on the service SSH.	Source
`blocklist.net.emergingthreats.compromised_ips`	From emergingthreats.net: Emerging Threats Intelligence from Proofpoint provides information on IP addresses and domains that may be compromised.	Source
`blocklist.firehol_org.abusers_1d`	From firehol.org: An ipset made from blocklists that track abusers in the last 24 hours.	Source
`blocklist.firehol_org.abusers_30d`	From firehol.org: An ipset made from blocklists that track abusers in the last 30 days.	Source
`blocklist.firehol_org.level_1`	From firehol.org: The objective is to create a blacklist that can be safe enough to be used on all systems, with a firewall, to block access entirely, from and to its listed IPs. The key prerequisite for this cause, is to have no false positives. All IPs listed should be bad and should be blocked, without exceptions.	Source
`blocklist.firehol_org.level_2`	From firehol.org: An ipset made from blocklists that track attacks, during the last 48 hours.	Source
`blocklist.firehol_org.level_3`	From firehol.org: An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs than have been reported or detected in the last 30 days.	Source
`blocklist.org.spamhaus.drop.ipv4`	From spamhaus.org: Don’t Route Or Peer (DROP) lists the worst of the worst IP traffic. It is an advisory “drop all traffic”, containing IP ranges which are so dangerous to internet users that Spamhaus provides access to anyone who wants to add this layer of protection, free of charge.	Source
`blocklist.org.spamhaus.drop.ipv6`	From spamhaus.org: Don’t Route Or Peer (DROP) lists the worst of the worst IP traffic. It is an advisory “drop all traffic”, containing IP ranges which are so dangerous to internet users that Spamhaus provides access to anyone who wants to add this layer of protection, free of charge.	Source
`blocklist.org.team_cymru.fullbogons.ipv4`	From team-cymru.com: The traditional bogon prefixes, plus prefixes that have been allocated to RIRs but not yet assigned by those RIRs to ISPs, end-users, etc.	Source
`blocklist.org.team_cymru.fullbogons.ipv6`	From team-cymru.com: IPv6 “fullbogons”, all IPv6 prefixes that have not been allocated to RIRs and that have not been assigned by RIRs to ISPs, end-users, etc.	Source

Proxies / VPNs

Name	Description	Sources
`proxy.anonymous.firehol_org`	From firehol.org: An ipset that includes all the anonymizing IPs of the world. (includes: anonymous dm_tor firehol_proxies tor_exits)	Source
`proxy.anonymous.tor`	These IPs are actively serving as Tor Exit nodes.	Source
`proxy.open.firehol_org`	From firehol.org: An ipset made from all sources that track open proxies. It includes IPs reported or detected in the last 30 days.	Source
`proxy.vpn.mullvad`	IPs for Mullvad VPN	Source
`proxy.vpn.nordvpn`	IPs for NordVPN	Source
`proxy.vpn.pia`	IPs for Private Internet Access VPN	Source

Public lists

Name	Description	Sources
`public.brianhama.bad-asn-list`	From Bad ASN List: An open source list of ASNs known to belong to cloud, managed hosting, and colo facilities.	IPs looked up from here

Organizations

Ahrefs

Name	Description	Sources
`com.ahrefs`	IPs from Ahrefs	Source

Algolia

Name	Description	Sources
`com.algolia.crawer`	IPs from Algolia Crawler	Source

Amazon Web Services (AWS)

Name	Description	Sources
`com.aws.sns`	IPs from AWS SNS service	Source
`com.aws.us-east-1.sns`	IPs from AWS SNS service for the `us-east-1` region	Source
`com.aws.us-east-2.sns`	IPs from AWS SNS service for the `us-east-2` region	Source
`com.aws.us-west-1.sns`	IPs from AWS SNS service for the `us-west-1` region	Source
`com.aws.us-west-2.sns`	IPs from AWS SNS service for the `us-west-2` region	Source
`com.aws`	IPs from AWS	Source

Anthropic

Name	Description	Sources
`com.anthropic.api`	IPs for Anthropic	Source

Apple

Name	Description	Sources
`com.apple.applebot.ipv4`	Applebot, the web crawler for Apple.	Source
`com.apple.icloud-private-relay`	From Apple: iCloud Private Relay is an internet privacy service offered as a part of an iCloud+ subscription that allows users on iOS 15, iPadOS 15, and macOS Monterey and later to connect to and browse the web more privately and securely.	Source

Atlassian

Name	Description	Sources
`com.atlassian.bitbucket`	IPs for Atlassian Bitbucket	Source
`com.atlassian.confluence`	IPs for Atlassian Confluence	Source
`com.atlassian.email`	IPs for Atlassian Email	Source
`com.atlassian.forge`	IPs for Atlassian Forge	Source
`com.atlassian.halp`	IPs for Atlassian Halp	Source
`com.atlassian.jira`	IPs for Atlassian Jira	Source
`com.atlassian.loom`	IPs for Atlassian Loom	Source
`com.atlassian.opsgenie`	IPs for Atlassian OpsGenie	Source
`com.atlassian.statuspage`	IPs for Atlassian StatusPage	Source
`com.atlassian.trello`	IPs for Atlassian Trello	Source

Babbar

Name	Description	Sources
`tech.babbar.barkrowler`	IPs for Babbar Barkrowler	Source

BetterStack

Name	Description	Sources
`com.betterstack.betteruptimebot`	IPs for BetterUptimeBot	Source

Bing (Microsoft)

Name	Description	Sources
`com.bing.bingbot.ipv4`	IPs for BingBot	Source

Brevo

Name	Description	Sources
`com.brevo.webhooks`	IPs for Brevo Webhooks	Source

Bunny CDN

Name	Description	Sources
`net.bunny.<ipv4 \| ipv6>`	IPs for Bunny CDN	IPv4 IPv6

Censys

Name	Description	Sources
`io.censys.scanners`	The IPs that Censys bots use to continually scan the entire public IPv4 address space across all possible IP and port combinations using automatic protocol detection.	Source

Cloudflare

Name	Description	Sources
`com.cloudflare.ipv4`	IPv4s from Cloudflare	IPv4, IPv6
`com.cloudflare.ipv6`	IPv6s from Cloudflare	IPv4, IPv6

Common Crawl (CCBot)

Name	Description	Sources
`org.commoncrawl.ccbot`	The IPs for CCBot	Source

Criteo

Name	Description	Sources
`com.criteo.criteobot`	The IPs for Criteo Criteobot	Source

DigitalOcean

Name	Description	Sources
`com.digitalocean`	IPs from DigitalOcean	Source

Datadog

Name	Description	Sources
`com.datadog`	IPs for Datadog	Source
`com.datadog.agents`	IPs for Datadog Agents	Source
`com.datadog.api`	IPs for Datadog API	Source
`com.datadog.apm`	IPs for Datadog APM	Source
`com.datadog.global`	IPs for Datadog Global	Source
`com.datadog.logs`	IPs for Datadog Logs	Source
`com.datadog.orchestrator`	IPs for Datadog Orchestrators	Source
`com.datadog.process`	IPs for Datadog Processes	Source
`com.datadog.remote-configuration`	IPs for Datadog Remote Configurations	Source
`com.datadog.synthetics-private-locations`	IPs for Datadog Synthetics Private Locations	Source
`com.datadog.synthetics`	IPs for Datadog Synthetics	Source
`com.datadog.webhooks`	IPs for Datadog Webhooks	Source

Delinea

Name	Description	Sources
`com.delinea.<ipv4 \| ipv6>`	IPs for Delinea	Source

DuckDuckGo

Name	Description	Sources
`com.duckduckgo.duckduckbot`	IPs for DuckDuckBot	Source

Fastly

Name	Description	Sources
`com.fastly.<ipv4 \| ipv6>`	IPs for Fastly	Source

Firehol

Name	Description	Sources
`blocklist.firehol_org.level_4`	From firehol.org: An ipset made from blocklists that track attacks, but may include a large number of false positives.	Source
`blocklist.firehol_org.webserver`	From firehol.org: A web server IP blacklist made from blocklists that track IPs that should never be used by your web users. This list includes IPs that are servers hosting malware, bots, etc or users having a long criminal history.	Source

Github

Name	Description	Sources
`com.github.actions_macos`	IPs for Github Actions from MacOS	Source
`com.github.actions`	IPs for Github Actions	Source
`com.github.api`	IPs for the Github API	Source
`com.github.codespaces`	IPs for Github Code Spaces	Source
`com.github.copilot`	IPs for Github CoPilot	Source
`com.github.dependabot`	IPs for Github Dependabot	Source
`com.github.git`	IPs for Github Git	Source
`com.github.github_enterprise_importer`	IPs for Github Enterprise Importer	Source
`com.github.hooks`	IPs for Github Webhooks	Source
`com.github.importer`	IPs for Github Importer	Source
`com.github.packages`	IPs for Github Packages	Source
`com.github.pages`	IPs for Github Pages	Source
`com.github.web`	IPs for Github Web	Source

GitLab

Name	Description	Sources
`com.gitlab.webhooks`	IPs for GitLab Webhooks	Source

Google

Name	Description	Sources
`com.google.<ipv4 \| ipv6>`	IPs for Google	Source
`com.google.googlebot.<ipv4 \| ipv6>`	IPs for GoogleBot	Source

IBM

Name	Description	Sources
`com.ibm.advmon_nimsoft`	IPs for IBM AdvMon (Nimsoft). Based on the IP Ranges Calculater Tool.	Source
`com.ibm.file_block`	IPs for IBM File & Block. Based on the IP Ranges Calculater Tool.	Source
`com.ibm.icos`	IPs for IBM ICOS. Based on the IP Ranges Calculater Tool.	Source
`com.ibm.ims`	IPs for IBM IMS. Based on the IP Ranges Calculater Tool.	Source
`com.ibm.rhel`	IPs for IBM RHEL. Based on the IP Ranges Calculater Tool.	Source
`com.ibm.ssl_vpn`	IPs for IBM SSL VPN. Based on the IP Ranges Calculater Tool.	Source
`com.ibm.service_network`	IPs for IBM Service Network. Based on the IP Ranges Calculater Tool.	Source
`com.ibm.evault`	IPs for IBM eVault. Based on the IP Ranges Calculater Tool.	Source

Linode (Akamai)

Name	Description	Sources
`com.linode`	IPs for Linode (now part of Akamai).	Source

Meta (Facebook)

Name	Description	Sources
`com.<meta \| facebook>.crawler`	IPs for Meta Web Crawlers.	Source

Microsoft Azure

Name	Description	Sources
`com.microsoft.azure`	IPs for Microsoft Azure	Source
`com.microsoft.azure.actiongroup`	IPs for Microsoft Azure ActionGroup	Source
`com.microsoft.azure.applicationinsightsavailability`	IPs for Microsoft Azure Application Insights Availability	Source
`com.microsoft.azure.autonomousdevelopmentplatform`	IPs for Microsoft Azure Autonomous Development Platform	Source
`com.microsoft.azure.azuread`	IPs for Microsoft Entra ID	Source
`com.microsoft.azure.azureadvancedthreatprotection`	IPs for Microsoft Azure Advanced Threat Protection	Source
`com.microsoft.azure.azureapiforfhir`	IPs for Microsoft Azure API For FHIR	Source
`com.microsoft.azure.azureapimanagement`	IPs for Microsoft Azure Api Management	Source
`com.microsoft.azure.azureappconfiguration`	IPs for Microsoft Azure App Configuration	Source
`com.microsoft.azure.azureappservice`	IPs for Microsoft Azure App Service	Source
`com.microsoft.azure.azureappservicemanagement`	IPs for Microsoft Azure App Service Management	Source
`com.microsoft.azure.azurearcinfrastructure`	IPs for Microsoft Azure Arc Infrastructure	Source
`com.microsoft.azure.azureattestation`	IPs for Microsoft Azure Attestation	Source
`com.microsoft.azure.azureautomation`	IPs for Microsoft Azure Automation	Source
`com.microsoft.azure.azurebackup`	IPs for Microsoft Azure Backup	Source
`com.microsoft.azure.azurebotservice`	IPs for Microsoft Azure Bot Service	Source
`com.microsoft.azure.azurecognitivesearch`	IPs for Microsoft Azure Cognitive Search	Source
`com.microsoft.azure.azureconnectors`	IPs for Microsoft Azure Connectors	Source
`com.microsoft.azure.azurecontainerregistry`	IPs for Microsoft Azure Container Registry	Source
`com.microsoft.azure.azurecosmosdb`	IPs for Microsoft Azure CosmosDB	Source
`com.microsoft.azure.azuredatabricks`	IPs for Microsoft Azure Databricks	Source
`com.microsoft.azure.azuredataexplorermanagement`	IPs for Microsoft Azure Data Explorer Management	Source
`com.microsoft.azure.azuredatalake`	IPs for Microsoft Azure Data Lake	Source
`com.microsoft.azure.azuredeviceupdate`	IPs for Microsoft Azure Device Update	Source
`com.microsoft.azure.azuredevops`	IPs for Microsoft Azure DevOps	Source
`com.microsoft.azure.azuredevspaces`	IPs for Microsoft Azure DevSpaces	Source
`com.microsoft.azure.azuredigitaltwins`	IPs for Microsoft Azure Digital Twins	Source
`com.microsoft.azure.azureeventgrid`	IPs for Microsoft Azure Event Grid	Source
`com.microsoft.azure.azureeventhub`	IPs for Microsoft Azure Event Hub	Source
`com.microsoft.azure.azurefrontdoor`	IPs for Microsoft Azure Front Door	Source
`com.microsoft.azure.azureidentity`	IPs for Microsoft Azure Identity	Source
`com.microsoft.azure.azureinformationprotection`	IPs for Microsoft Azure Information Protection	Source
`com.microsoft.azure.azureiothub`	IPs for Microsoft Azure IoT Hub	Source
`com.microsoft.azure.azurekeyvault`	IPs for Microsoft Azure Key Vault	Source
`com.microsoft.azure.azureloadtestinginstancemanagement`	IPs for Microsoft Azure Load Testing Instance Management	Source
`com.microsoft.azure.azuremachinelearning`	IPs for Microsoft Azure Machine Learning	Source
`com.microsoft.azure.azuremachinelearninginference`	IPs for Microsoft Azure Machine Learning Inference	Source
`com.microsoft.azure.azuremanagedgrafana`	IPs for Microsoft Azure Managed Grafana	Source
`com.microsoft.azure.azuremonitor`	IPs for Microsoft Azure Monitor	Source
`com.microsoft.azure.azuremonitorforsap`	IPs for Microsoft Azure Monitor For SAP	Source
`com.microsoft.azure.azureopendatasets`	IPs for Microsoft Azure Open Datasets	Source
`com.microsoft.azure.azureportal`	IPs for Microsoft Azure Portal	Source
`com.microsoft.azure.azureresourcemanager`	IPs for Microsoft Azure Resource Manager	Source
`com.microsoft.azure.azuresecuritycenter`	IPs for Microsoft Azure Security Center	Source
`com.microsoft.azure.azuresentinel`	IPs for Microsoft Azure Sentinel	Source
`com.microsoft.azure.azureservicebus`	IPs for Microsoft Azure Service Bus	Source
`com.microsoft.azure.azuresignalr`	IPs for Microsoft Azure SignalR	Source
`com.microsoft.azure.azuresiterecovery`	IPs for Microsoft Azure Site Recovery	Source
`com.microsoft.azure.azurespheresecureservice_prod`	IPs for Microsoft Azure Sphere Secure Service Prod	Source
`com.microsoft.azure.azurespringcloud`	IPs for Microsoft Azure Spring Cloud	Source
`com.microsoft.azure.azuresql`	IPs for Microsoft Azure SQL	Source
`com.microsoft.azure.azurestack`	IPs for Microsoft Azure Stack	Source
`com.microsoft.azure.azurestorage`	IPs for Microsoft Azure Storage	Source
`com.microsoft.azure.azuretrafficmanager`	IPs for Microsoft Azure Traffic Manager	Source
`com.microsoft.azure.azureupdatedelivery`	IPs for Microsoft Azure Update Delivery	Source
`com.microsoft.azure.azurevideoanalyzerformedia`	IPs for Microsoft Azure Video Analyzer For Media	Source
`com.microsoft.azure.azurewebpubsub`	IPs for Microsoft Azure Web PubSub	Source
`com.microsoft.azure.batchnodemanagement`	IPs for Microsoft Azure Batch Node Management	Source
`com.microsoft.azure.chaosstudio`	IPs for Microsoft Azure Chaos Studio	Source
`com.microsoft.azure.cognitiveservicesfrontend`	IPs for Microsoft Azure Cognitive Services Frontend	Source
`com.microsoft.azure.cognitiveservicesmanagement`	IPs for Microsoft Azure Cognitive Services Management	Source
`com.microsoft.azure.datafactory`	IPs for Microsoft Azure Data Factory	Source
`com.microsoft.azure.dynamics365businesscentral`	IPs for Microsoft Azure Dynamics 365 Business Central	Source
`com.microsoft.azure.dynamics365formarketingemail`	IPs for Microsoft Azure Dynamics 365 For Marketing Email	Source
`com.microsoft.azure.eopextpublished`	IPs for Microsoft Azure EOP Ext Published	Source
`com.microsoft.azure.gatewaymanager`	IPs for Microsoft Azure Gateway Manager	Source
`com.microsoft.azure.grafana`	IPs for Microsoft Azure Grafana	Source
`com.microsoft.azure.hdinsight`	IPs for Microsoft Azure HDInsight	Source
`com.microsoft.azure.logicapps`	IPs for Microsoft Azure Logic Apps	Source
`com.microsoft.azure.m365managementactivityapi`	IPs for Microsoft Azure M365 Management Activity Api	Source
`com.microsoft.azure.m365managementactivityapiwebhook`	IPs for Microsoft Azure M365 Management Activity Api Webhook	Source
`com.microsoft.azure.marketplace`	IPs for Microsoft Azure Marketplace	Source
`com.microsoft.azure.microsoftazurefluidrelay`	IPs for Microsoft Azure Microsoft Azure Fluid Relay	Source
`com.microsoft.azure.microsoftcloudappsecurity`	IPs for Microsoft Azure Microsoft Cloud App Security	Source
`com.microsoft.azure.microsoftcontainerregistry`	IPs for Microsoft Azure Microsoft Container Registry	Source
`com.microsoft.azure.microsoftdefenderforendpoint`	IPs for Microsoft Azure Microsoft Defender For Endpoint	Source
`com.microsoft.azure.microsoftpurviewpolicydistribution`	IPs for Microsoft Azure Microsoft Purview Policy Distribution	Source
`com.microsoft.azure.onedscollector`	IPs for Microsoft Azure One Ds Collector	Source
`com.microsoft.azure.powerbi`	IPs for Microsoft Azure Power BI	Source
`com.microsoft.azure.powerplatforminfra`	IPs for Microsoft Azure Power Platform Infra	Source
`com.microsoft.azure.powerplatformplex`	IPs for Microsoft Azure Power Platform Plex	Source
`com.microsoft.azure.powerqueryonline`	IPs for Microsoft Azure Power Query Online	Source
`com.microsoft.azure.sccservice`	IPs for Microsoft Azure SCCservice	Source
`com.microsoft.azure.scuba`	IPs for Microsoft Azure Scuba	Source
`com.microsoft.azure.securitycopilot`	IPs for Microsoft Azure Security Copilot	Source
`com.microsoft.azure.serialconsole`	IPs for Microsoft Azure Serial Console	Source
`com.microsoft.azure.servicefabric`	IPs for Microsoft Azure Service Fabric	Source
`com.microsoft.azure.sqlmanagement`	IPs for Microsoft Azure Sql Management	Source
`com.microsoft.azure.storagemover`	IPs for Microsoft Azure Storage Mover	Source
`com.microsoft.azure.storagesyncservice`	IPs for Microsoft Azure Storage Sync Service	Source
`com.microsoft.azure.tridentkusto`	IPs for Microsoft Azure Trident Kusto	Source
`com.microsoft.azure.windowsadmincenter`	IPs for Microsoft Azure Windows Admin Center	Source
`com.microsoft.azure.windowsvirtualdesktop`	IPs for Microsoft Azure Windows Virtual Desktop	Source
`com.microsoft.azure.wvdrelays`	IPs for Microsoft Azure WVD Relays	Source

Microsoft Office

Name	Description	Sources
`com.office.common.china`	IPs for Microsoft Office in China.	Source
`com.office.common.usgovdod`	IPs for Microsoft Office for U.S. Government DoD plans only.	Source
`com.office.common.usgovgcchigh`	IPs for Microsoft Office for U.S. Government GCC High plans only.	Source
`com.office.common.worldwide`	IPs for Microsoft Office worldwide.	Source
`com.office.exchange.china`	IPs for Microsoft Exchange in China.	Source
`com.office.exchange.usgovdod`	IPs for Microsoft Exchange for U.S. Government DoD plans only.	Source
`com.office.exchange.usgovgcchigh`	IPs for Microsoft Exchange for U.S. Government GCC High plans only.	Source
`com.office.exchange.worldwide`	IPs for Microsoft Exchange worldwide.	Source
`com.office.skype.china`	IPs for Microsoft Skype / Microsoft Teams in China.	Source
`com.office.skype.usgovdod`	IPs for Microsoft Skype / Microsoft Teams for U.S. Government DoD plans only.	Source
`com.office.skype.usgovgcchigh`	IPs for Microsoft Skype / Microsoft Teams for U.S. Government GCC High plans only.	Source
`com.office.skype.worldwide`	IPs for Microsoft Skype / Microsoft Teams worldwide.	Source
`com.office.sharepoint.china`	IPs for Microsoft SharePoint in China.	Source
`com.office.sharepoint.usgovdod`	IPs for Microsoft SharePoint for U.S. Government DoD plans only.	Source
`com.office.sharepoint.usgovgcchigh`	IPs for Microsoft SharePoint for U.S. Government GCC High plans only.	Source
`com.office.sharepoint.worldwide`	IPs for Microsoft SharePoint worldwide.	Source

Okta

Name	Description	Sources
`com.okta.apac`	IPs for Okta in the `apac` region.	Source
`com.okta.ca`	IPs for Okta in the `ca` region.	Source
`com.okta.emea`	IPs for Okta in the `emea` region.	Source
`com.okta.emea_pam`	IPs for Okta in the `emea_pam` region.	Source
`com.okta.in`	IPs for Okta in the `in` region.	Source
`com.okta.preview`	IPs for Okta in the `preview` region.	Source
`com.okta.preview_pam`	IPs for Okta in the `preview_pam` region.	Source
`com.okta.us`	IPs for Okta in the `us` region.	Source
`com.okta.us_pam`	IPs for Okta in the `us_pam` region.	Source

OpenAI (ChatGPT)

Name	Description	Sources
`com.openai.chatgpt.actions.ipv4`	IPs for OpenAI ChatGPT Actions.	Source
`com.openai.chatgpt.user.ipv4`	IPs for ChatGPT-User which is for user actions in ChatGPT and Custom GPTs.	Source
`com.openai.gptbot.ipv4`	IPs for GPTBot which is used to make our generative AI foundation models more useful and safe.	Source
`com.openai.searchbot.ipv4`	IPs for OpenAI Searchbot.	Source

Oracle

Name	Description	Sources
`com.oracle.object_storage`	IPs for Oracle Object Storage.	Source
`com.oracle.oci`	IPs for Oracle OCI.	Source
`com.oracle.osn`	IPs for Oracle OSN.	Source

Pagerduty

Name	Description	Sources
`com.pagerduty.webhooks.<us \| eu>`	IPs for Pagerduty Webhooks split out by region (`us` or `eu`).	Source

Perplexity AI

Name	Description	Sources
`ai.perplexity.bot.ipv4`	IPs for Perplexity AI bot.	Source
`ai.perplexity.user.ipv4`	IPs for Perplexity AI users.	Source

Pingdom

Name	Description	Sources
`com.pingdom.<ipv4 \| ipv6>`	IPs for Pingdom.	IPv4 IPv6

Plaid

Name	Description	Sources
`com.plaid.webhooks`	IPs for Plaid Webhooks.	Source

RingCentral

Name	Description	Sources
`com.ringcentral`	IPs for RingCentral.	Source

RSS API

Name	Description	Sources
`net.rssapi`	IPs for RSS API.	Source

Salesforce

Name	Description	Sources
`com.salesforce.core`	IPs for Salesforce.	Source
`com.salesforce.gov`	IPs for Salesforce Government Cloud.	Source
`com.salesforce.hyperforce`	IPs for Salesforce Hyperforce.	Source
`com.salesforce.news`	IPs for Salesforce News, Account Logos, and Automated Account Fields.	Source

Semrush

Name	Description	Sources
`com.semrush.semrushbot.siteaudit`	IPs for Semrush SiteAudit	Source
`com.semrush.splitsignalbot`	IPs for Semrush SplitSignalBot	Source

Stripe

Name	Description	Sources
`com.stripe.api`	The full list of IP addresses that api.stripe.com may resolve to	Source
`com.stripe.armada_gator`	The full list of IP addresses that files.stripe.com, armada.stripe.com, and gator.stripe.com may resolve to	Source
`com.stripe.webhooks`	The full list of IP addresses that Stripe webhook notifications may come from	Source

Svix

Name	Description	Sources
`com.svix.webhooks`	IPs for Svix webhooks.	Source

Name	Description	Sources
`org.telegram`	IPs for Telegram Bots	Source

Teleport

Name	Description	Sources
`com.teleport`	Public address allow list for Teleport	Source

Telnyx

Name	Description	Sources
`com.telnyx.media`	IPs for Telnyx Media	Source
`com.telnyx.webhooks`	IPs for Telnyx Webhooks	Source

UptimeRobot

Name	Description	Sources
`com.uptimerobot.<ipv4 \| ipv6>`	IPs for UptimeRobot	Source

Vultr

Name	Description	Sources
`com.vultr`	IPs for Vultr	Source

WebPageTest

Name	Description	Sources
`org.webpagetest`	IPs for WebPageTest	Source

X (Twitter)

Name	Description	Sources
`com.x.twitterbot`	IPs for X.com Twitterbot	Source

Yandex

Name	Description	Sources
`com.yandex`	IPs for Yandex	Source

Zendesk

Name	Description	Sources
`com.zendesk`	IPs for Zendesk	Source

Zoom

Name	Description	Sources
`us.zoom`	IPs for Zoom	Source
`us.zoom.meetings.<ipv4 \| ipv6>`	IPs for Zoom Meetings	IPv4 IPv6
`us.zoom.crc`	IPs for Zoom Cloud Room Connector	Source
`us.zoom.phone.<ipv4 \| ipv6>`	IPs for Zoom Phone	IPv4 IPv6
`us.zoom.cc.<ipv4 \| ipv6>`	IPs for Zoom Contact Center	IPv4 IPv6
`us.zoom.zva`	IPs for Zoom Virtual Agent	Source
`us.zoom.cdn.<ipv4 \| ipv6>`	IPs for Zoom CDN	IPv4 IPv6
`us.zoom.apps.<ipv4 \| ipv6>`	IPs for Zoom Apps	IPv4 IPv6

Zscaler

Name	Description	Sources
`com.zscaler.private.zpa`	Zscaler Private Access Firewall Allowlist for private.zscaler.com	Source
`net.zdxbeta.future`	Zscaler Egress IP ranges and Future Data Centers for zdxbeta.net	Source
`net.zdxbeta.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zdxbeta.net	Required, Recommended
`net.zdxcloud.future`	Zscaler Egress IP ranges and Future Data Centers for zdxcloud.net	Source
`net.zdxcloud.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zdxcloud.net	Required, Recommended
`net.zdxgov.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zdxgov.net	Required, Recommended
`net.zdxten.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zdxten.net	Required, Recommended
`net.zdxten.zpa`	Zscaler Private Access Firewall Allowlist for zdxten.net	Source
`net.zpabeta.zpa`	Zscaler Private Access Firewall Allowlist for zpabeta.net	Source
`net.zpagov.zpa`	Zscaler Private Access Firewall Allowlist for zpagov.net	Source
`net.zpatwo.zpa`	Zscaler Private Access Firewall Allowlist for zpatwo.net	Source
`net.zscaler.cenr.<continent>`	Current Data Centers for zscaler.net	Source
`net.zscaler.future`	Zscaler Aggregate IP Address Ranges for zscaler.net	Source
`net.zscaler.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscaler.net	Required, Recommended
`net.zscaler.zpa`	Zscaler Private Access Firewall Allowlist for zscaler.net	Source
`net.zscalerbeta.cenr.<continent>`	Current Data Centers for zscalerbeta.net	Source
`net.zscalerbeta.future`	Zscaler Aggregate IP Address Ranges for zscalerbeta.net	Source
`net.zscalerbeta.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscalerbeta.net	Required, Recommended
`net.zscalerbeta.zpa`	Zscaler Private Access Firewall Allowlist for zscalerbeta.net	Source
`net.zscalergov.cenr.<continent>`	Current Data Centers for zscalergov.net	Source
`net.zscalergov.future`	Zscaler Aggregate IP Address Ranges for zscalergov.net	Source
`net.zscalergov.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscalergov.net	Required, Recommended
`net.zscalergov.zpa`	Zscaler Private Access Firewall Allowlist for zscalergov.net	Source
`net.zscalerone.cenr.<continent>`	Current Data Centers for zscalerone.net	Source
`net.zscalerone.future`	Zscaler Aggregate IP Address Ranges for zscalerone.net	Source
`net.zscalerone.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscalerone.net	Required, Recommended
`net.zscalerone.zpa`	Zscaler Private Access Firewall Allowlist for zscalerone.net	Source
`net.zscalerten.cenr.<continent>`	Current Data Centers for zscalerten.net	Source
`net.zscalerten.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscalerten.net	Required, Recommended
`net.zscalerten.zpa`	Zscaler Private Access Firewall Allowlist for zscalerten.net	Source
`net.zscalerthree.cenr.<continent>`	Current Data Centers for zscalerthree.net	Source
`net.zscalerthree.future`	Zscaler Aggregate IP Address Ranges for zscalerthree.net	Source
`net.zscalerthree.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscalerthree.net	Required, Recommended
`net.zscalerthree.zpa`	Zscaler Private Access Firewall Allowlist for zscalerthree.net	Source
`net.zscalertwo.cenr.<continent>`	Current Data Centers for zscalertwo.net	Source
`net.zscalertwo.future`	Zscaler Aggregate IP Address Ranges for zscalertwo.net	Source
`net.zscalertwo.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscalertwo.net	Required, Recommended
`net.zscalertwo.zpa`	Zscaler Private Access Firewall Allowlist for zscalertwo.net	Source
`net.zscloud.cenr.<continent>`	Current Data Centers for zscloud.net	Source
`net.zscloud.future`	Zscaler Aggregate IP Address Ranges for zscloud.net	Source
`net.zscloud.hubs.<required \| recommended>`	Zscaler Hub IP Addresses for zscloud.net	Required, Recommended
`net.zscloud.zpa`	Zscaler Private Access Firewall Allowlist for zpatwo.net	Source
`us.zpagov.zpa`	Zscaler Private Access Firewall Allowlist for zpagov.us	Source

Endpoint Variables HTTP Request Variables

​Client IP Intelligence

​conn.client_ip.categories

​conn.client_ip.is_on_blocklist

​conn.client_ip.is_tor_node

​Client IP Autonomous System

​conn.client_ip.as.number

​conn.client_ip.as.organization

​Client IP Geo Location

​conn.client_ip.geo.location.city

​conn.client_ip.geo.location.continent

​conn.client_ip.geo.location.country

​conn.client_ip.geo.location.country_code

​conn.client_ip.geo.location.is_eu

​conn.client_ip.geo.location.latitude

​conn.client_ip.geo.location.longitude

​conn.client_ip.geo.location.metro_code

​conn.client_ip.geo.location.postal_code

​conn.client_ip.geo.location.radius

​conn.client_ip.geo.location.subdivision

​conn.client_ip.geo.location.timezone

​Client IP Registered Geo Location

​conn.client_ip.geo.registered_location.city

​conn.client_ip.geo.registered_location.continent

​conn.client_ip.geo.registered_location.country

​conn.client_ip.geo.registered_location.country_code

​conn.client_ip.geo.registered_location.is_eu

​conn.client_ip.geo.registered_location.subdivision

​conn.client_ip.geo.registered_location.metro_code

​conn.client_ip.geo.registered_location.timezone

​Server IP Intelligence

​conn.server_ip.categories

​conn.server_ip.is_on_blocklist

​conn.server_ip.is_tor_node

​Server IP Autonomous System

​conn.server_ip.as.number

​conn.server_ip.as.organization

​Server IP Location Geo

​conn.server_ip.geo.location.city

​conn.server_ip.geo.location.continent

​conn.server_ip.geo.location.country

​conn.server_ip.geo.location.country_code

​conn.server_ip.geo.location.is_eu

​conn.server_ip.geo.location.latitude

​conn.server_ip.geo.location.longitude

​conn.server_ip.geo.location.metro_code

​conn.server_ip.geo.location.postal_code

​conn.server_ip.geo.location.radius

​conn.server_ip.geo.location.subdivision

​conn.server_ip.geo.location.timezone

​Server IP Registered Location Geo

​conn.server_ip.geo.registered_location.city

​conn.server_ip.geo.registered_location.continent

​conn.server_ip.geo.registered_location.country

​conn.server_ip.geo.registered_location.country_code

​conn.server_ip.geo.registered_location.is_eu

​conn.server_ip.geo.registered_location.subdivision

​conn.server_ip.geo.registered_location.metro_code

​conn.server_ip.geo.registered_location.timezone

​IP Categories

​Blocklists

​Proxies / VPNs

​Public lists

​Organizations

​Ahrefs

​Algolia

​Amazon Web Services (AWS)

​Anthropic

​Apple

​Atlassian

​Babbar

​BetterStack

​Bing (Microsoft)

​Brevo

​Bunny CDN

​Censys

​Cloudflare

​Common Crawl (CCBot)

​Criteo

​DigitalOcean

​Datadog