Datacenter & cloud IP ranges,
tracked live.
Maskbreak ingests the published IP ranges of 9 major hosting and CDN providers daily — 87,137 prefixes as of 4 September 2026 — and folds them into every verdict as the dch signal.
How Maskbreak uses these ranges
The numbers below come from each provider's own published range feed — the same feeds the verdict pipeline refreshes daily, so a new range is scored within a day of publication rather than whenever a static database ships.
Range data adds a signal; it never overrides deeper network detection. VPN exits live in datacenters, so a range hit does not short-circuit tunnel analysis — an address inside a provider's ranges that is also a VPN exit gets both signals, and your policy sees the full picture in the reasons array.
Should you block datacenter traffic?
It depends on the surface, and answering it per-surface rather than per-provider is the whole point. A datacenter IP on a signup, login, or checkout is a strong review signal — humans overwhelmingly arrive from residential and mobile networks. The same address calling your API is usually a legitimate backend. Maskbreak returns the raw signal so you can apply that asymmetric policy instead of a blanket block.
curl -X POST https://maskbreak.com/v1/evaluate \ -H "Authorization: Bearer sk_test_sandbox" \ -H "Content-Type: application/json" \ -d '{"token":"test_datacenter"}'
The sandbox key returns the documented datacenter-verdict shape (decision, risk_score, network.datacenter) — no signup required. Details in the API docs.
Provider by provider
Ordered by IPv4 footprint. Counts are a 4 September 2026 snapshot; production refreshes daily.
AWS
Amazon Web Services is the largest public cloud. Its published IP ranges cover EC2, Lambda, and every other compute surface an attacker can rent by the minute.
Cheap, instantly provisioned compute makes AWS a default launchpad for scrapers, credential-stuffing runners, and headless-browser farms — while also carrying enormous volumes of legitimate server-to-server traffic.
Microsoft Azure
Microsoft Azure publishes the most granular range set of any cloud — tens of thousands of per-service prefixes.
Azure VMs and Functions appear in bot traffic for the same reason AWS does: minute-billed compute with a clean corporate ASN. Legitimate enterprise integrations also live here in volume.
Google Cloud
Google Cloud Platform publishes its customer-usable ranges separately from Google’s own crawler infrastructure — these pages track the customer ranges.
GCP free-tier credits have historically made it a favourite for burst scraping and abuse experiments; its ranges also host plenty of legitimate APIs.
Oracle Cloud
Oracle Cloud Infrastructure is the smallest of the big-four clouds, with a generous always-free tier.
That always-free tier makes OCI disproportionately popular for hobby bots and low-budget abuse relative to its size.
DigitalOcean
DigitalOcean droplets are the classic five-dollar VPS: instant, anonymous-ish, and everywhere in bot traffic.
Developer clouds like DigitalOcean show up in fraud far more per-IP than the hyperscalers do: a fresh droplet with a residential-looking browser on top is a standard scraping and multi-accounting setup.
Cloudflare
Cloudflare publishes the egress ranges of its CDN and WARP infrastructure. Most traffic you see *through* Cloudflare carries the visitor’s real IP in headers — these ranges matter when a request *originates* from Cloudflare infrastructure itself.
A request originating from CDN infrastructure (rather than being proxied through it for a website) is unusual for a human visitor — commonly a Worker, a WARP exit, or automation.
Cloudflare is a CDN, so the useful distinction is traffic originating from these ranges rather than traffic merely served through them — the dch signal applies to the former.
Linode/Akamai
Linode (now Akamai Connected Cloud) is one of the oldest VPS providers, with a large, well-published range set.
Like every low-cost VPS host, Linode ranges appear regularly in automation traffic; a datacenter flag here on a checkout or signup deserves weight.
Vultr
Vultr sells hourly VPS instances in dozens of regions, popular for lightweight proxies and automation runners.
Small, cheap, many-region VPS hosts are exactly where one-off proxy exits and bot runners get spun up — and torn down before blocklists catch up.
Fastly
Fastly publishes its CDN edge ranges. Like Cloudflare, requests originating from these ranges — rather than being served through them — are the signal of interest.
Compute@Edge and similar products mean code, not people, initiates connections from these ranges.
Fastly is a CDN, so the useful distinction is traffic originating from these ranges rather than traffic merely served through them — the dch signal applies to the former.
Free tier: 1,000 requests/hour. No card, no expiry.