IP Intelligence Authority Platform
Well-known IP addresses
Public DNS resolvers, root servers, time servers and more
Some IP addresses are famous in their own right: the public DNS resolvers people type into network settings, the root servers at the top of the DNS, and the time servers every device polls. This directory lists 112 of them, grouped by role. Each address links to its full IPDebrief profile with ownership, routing, reverse DNS and risk data.
Public DNS resolvers
Recursive resolvers anyone can use instead of their ISP's DNS. Many operators run several addresses: an unfiltered resolver, a malware-blocking variant and a family-safe variant, each with IPv4 and IPv6 addresses. Seeing one of these as a source address is normal for DNS traffic; seeing one connect to a web application is not, because resolvers do not browse.
| Address | Name | Operator | About |
|---|---|---|---|
94.140.14.14 | AdGuard DNS (Primary) | AdGuard Software | AdGuard DNS ad-blocking resolver |
94.140.14.15 | AdGuard DNS Family (Primary) | AdGuard Software | AdGuard resolver that blocks ads, trackers and adult content |
94.140.15.15 | AdGuard DNS (Secondary) | AdGuard Software | AdGuard DNS secondary resolver |
223.5.5.5 | AliDNS (Primary) | Alibaba Cloud | Alibaba Cloud public DNS resolver, widely used in China |
223.6.6.6 | AliDNS (Secondary) | Alibaba Cloud | Secondary Alibaba Cloud public DNS resolver |
180.76.76.76 | Baidu Public DNS | Baidu | Baidu public DNS resolver |
208.67.220.123 | OpenDNS FamilyShield (Secondary) | Cisco Umbrella | Secondary OpenDNS FamilyShield resolver |
208.67.220.220 | OpenDNS Home (Secondary) | Cisco Umbrella | OpenDNS secondary resolver |
208.67.222.123 | OpenDNS FamilyShield (Primary) | Cisco Umbrella | OpenDNS resolver that pre-blocks adult content |
208.67.222.222 | OpenDNS Home (Primary) | Cisco Umbrella | OpenDNS primary resolver, now operated by Cisco Umbrella |
2620:119:35::35 | OpenDNS IPv6 (Primary) | Cisco Umbrella | IPv6 address of the OpenDNS public resolver |
2620:119:53::53 | OpenDNS IPv6 (Secondary) | Cisco Umbrella | Secondary IPv6 address of the OpenDNS public resolver |
185.228.168.9 | CleanBrowsing (Security) | CleanBrowsing Inc | CleanBrowsing security filter DNS |
185.228.168.168 | CleanBrowsing (Family) | CleanBrowsing Inc | CleanBrowsing family filter resolver |
1.0.0.1 | Cloudflare DNS (Secondary) | Cloudflare Inc | Cloudflare's secondary public DNS resolver |
1.0.0.2 | Cloudflare for Families (Malware, Secondary) | Cloudflare Inc | Secondary Cloudflare resolver that blocks known malware domains |
1.0.0.3 | Cloudflare for Families (Malware + Adult, Secondary) | Cloudflare Inc | Secondary Cloudflare resolver that blocks malware and adult content |
1.1.1.1 | Cloudflare DNS (Primary) | Cloudflare Inc | Cloudflare's privacy-focused public DNS resolver, one of the fastest DNS services |
1.1.1.2 | Cloudflare for Families (Malware) | Cloudflare Inc | Cloudflare public resolver that blocks known malware domains |
1.1.1.3 | Cloudflare for Families (Malware + Adult) | Cloudflare Inc | Cloudflare public resolver that blocks malware and adult content |
2606:4700:4700::1001 | Cloudflare DNS IPv6 (Secondary) | Cloudflare Inc | IPv6 address of Cloudflare's 1.0.0.1 public DNS resolver |
2606:4700:4700::1111 | Cloudflare DNS IPv6 (Primary) | Cloudflare Inc | IPv6 address of Cloudflare's 1.1.1.1 public DNS resolver |
8.20.247.20 | Comodo Secure DNS (Secondary) | Comodo | Secondary Comodo Secure DNS filtering resolver |
8.26.56.26 | Comodo Secure DNS (Primary) | Comodo | Comodo Secure DNS filtering resolver |
76.76.2.0 | Control D DNS (Primary) | Control D | Control D free public DNS resolver (unfiltered) |
76.76.10.0 | Control D DNS (Secondary) | Control D | Control D free public DNS resolver (unfiltered), secondary address |
8.8.4.4 | Google Public DNS (Secondary) | Google LLC | Google's secondary public DNS resolver |
8.8.8.8 | Google Public DNS (Primary) | Google LLC | Google's primary public DNS resolver, one of the most widely used DNS services globally |
2001:4860:4860::6464 | Google Public DNS64 | Google LLC | Google's DNS64 resolver for IPv6-only networks using NAT64 |
2001:4860:4860::8844 | Google Public DNS IPv6 (Secondary) | Google LLC | IPv6 address of Google's secondary public DNS resolver |
2001:4860:4860::8888 | Google Public DNS IPv6 (Primary) | Google LLC | IPv6 address of Google's primary public DNS resolver |
168.126.63.1 | KT DNS (Primary) | KT Corporation | Korea Telecom public DNS resolver |
4.2.2.1 | Level 3 DNS (4.2.2.1) | Lumen Technologies | Long-standing Level 3 (now Lumen) recursive resolver, widely used in network diagnostics |
4.2.2.2 | Level 3 DNS (4.2.2.2) | Lumen Technologies | Long-standing Level 3 (now Lumen) recursive resolver, widely used in network diagnostics |
194.242.2.2 | Mullvad DNS | Mullvad VPN AB | Mullvad's public DNS-over-HTTPS and DNS-over-TLS resolver |
114.114.114.114 | 114DNS (Primary) | Nanjing Xinfeng | 114DNS public resolver, one of the most used resolvers in China |
45.90.28.0 | NextDNS Anycast | NextDNS Inc | NextDNS configurable privacy-focused DNS resolver |
9.9.9.9 | Quad9 DNS (Primary) | Quad9 Foundation | Quad9's threat-blocking public DNS resolver operated by the Quad9 Foundation |
9.9.9.10 | Quad9 DNS (Unsecured) | Quad9 Foundation | Quad9 resolver without threat blocking or DNSSEC validation |
9.9.9.11 | Quad9 DNS (ECS) | Quad9 Foundation | Quad9 threat-blocking resolver with EDNS Client Subnet support |
149.112.112.112 | Quad9 DNS (Secondary) | Quad9 Foundation | Quad9's secondary public DNS resolver |
2620:fe::9 | Quad9 DNS IPv6 (Secondary) | Quad9 Foundation | Secondary IPv6 address of Quad9's public DNS resolver |
2620:fe::fe | Quad9 DNS IPv6 (Primary) | Quad9 Foundation | IPv6 address of Quad9's threat-blocking public DNS resolver |
119.29.29.29 | DNSPod Public DNS | Tencent Cloud | Tencent DNSPod public DNS resolver |
101.101.101.101 | Quad101 DNS | TWNIC | Taiwan Network Information Center public DNS resolver |
77.88.8.1 | Yandex DNS (Secondary) | Yandex | Secondary Yandex public DNS resolver |
77.88.8.8 | Yandex DNS (Primary) | Yandex | Yandex public DNS resolver |
DNS root servers
The thirteen root server identities (a.root-servers.net to m.root-servers.net) answer for the top of the DNS hierarchy. Each identity has one IPv4 and one IPv6 address, served by hundreds of anycast instances worldwide.
| Address | Name | Operator | About |
|---|---|---|---|
192.33.4.12 | C Root DNS Server | Cogent | C.root-servers.net — operated by Cogent Communications |
2001:500:2::c | C Root DNS Server (IPv6) | Cogent | IPv6 address of c.root-servers.net, operated by Cogent Communications |
192.112.36.4 | G Root DNS Server | DISA | G.root-servers.net — operated by Defense Information Systems Agency |
2001:500:12::d0d | G Root DNS Server (IPv6) | DISA | IPv6 address of g.root-servers.net, operated by the Defense Information Systems Agency |
199.7.83.42 | L Root DNS Server | ICANN | L.root-servers.net — operated by ICANN |
2001:500:9f::42 | L Root DNS Server (IPv6) | ICANN | IPv6 address of l.root-servers.net, operated by ICANN |
192.5.5.241 | F Root DNS Server | ISC | F.root-servers.net — operated by Internet Systems Consortium |
2001:500:2f::f | F Root DNS Server (IPv6) | ISC | IPv6 address of f.root-servers.net, operated by Internet Systems Consortium |
192.203.230.10 | E Root DNS Server | NASA Ames | E.root-servers.net — operated by NASA Ames Research Center |
2001:500:a8::e | E Root DNS Server (IPv6) | NASA Ames | IPv6 address of e.root-servers.net, operated by NASA Ames Research Center |
192.36.148.17 | I Root DNS Server | Netnod | I.root-servers.net — operated by Netnod (Sweden) |
2001:7fe::53 | I Root DNS Server (IPv6) | Netnod | IPv6 address of i.root-servers.net, operated by Netnod (Sweden) |
193.0.14.129 | K Root DNS Server | RIPE NCC | K.root-servers.net — operated by RIPE NCC |
2001:7fd::1 | K Root DNS Server (IPv6) | RIPE NCC | IPv6 address of k.root-servers.net, operated by RIPE NCC |
199.7.91.13 | D Root DNS Server | University of Maryland | D.root-servers.net — operated by University of Maryland |
2001:500:2d::d | D Root DNS Server (IPv6) | University of Maryland | IPv6 address of d.root-servers.net, operated by the University of Maryland |
198.97.190.53 | H Root DNS Server | US Army | H.root-servers.net — operated by US Army Research Lab |
2001:500:1::53 | H Root DNS Server (IPv6) | US Army | IPv6 address of h.root-servers.net, operated by the US Army Research Lab |
170.247.170.2 | B Root DNS Server | USC-ISI | B.root-servers.net — operated by USC Information Sciences Institute |
2801:1b8:10::b | B Root DNS Server (IPv6) | USC-ISI | IPv6 address of b.root-servers.net, operated by USC Information Sciences Institute |
192.58.128.30 | J Root DNS Server | Verisign | J.root-servers.net — operated by Verisign |
198.41.0.4 | A Root DNS Server | Verisign | A.root-servers.net — operated by Verisign |
2001:503:c27::2:30 | J Root DNS Server (IPv6) | Verisign | IPv6 address of j.root-servers.net, operated by Verisign |
2001:503:ba3e::2:30 | A Root DNS Server (IPv6) | Verisign | IPv6 address of a.root-servers.net, operated by Verisign |
202.12.27.33 | M Root DNS Server | WIDE Project | M.root-servers.net — operated by WIDE Project (Japan) |
2001:dc3::35 | M Root DNS Server (IPv6) | WIDE Project | IPv6 address of m.root-servers.net, operated by the WIDE Project (Japan) |
Public time servers
Network Time Protocol servers that keep clocks synchronised. They are queried on UDP port 123 by operating systems, routers and IoT devices.
| Address | Name | Operator | About |
|---|---|---|---|
17.253.34.123 | Apple NTP Server | Apple Inc | time.apple.com — Apple's public NTP service |
162.159.200.1 | Cloudflare Time Service | Cloudflare Inc | time.cloudflare.com — Cloudflare's public NTP and NTS service |
162.159.200.123 | Cloudflare Time Service (2) | Cloudflare Inc | time.cloudflare.com — Cloudflare's public NTP and NTS service |
216.239.35.0 | Google NTP Server | Google LLC | time.google.com — Google's public NTP service |
216.239.35.4 | Google NTP Server (time2) | Google LLC | time2.google.com — Google's public leap-smeared NTP service |
216.239.35.8 | Google NTP Server (time3) | Google LLC | time3.google.com — Google's public leap-smeared NTP service |
216.239.35.12 | Google NTP Server (time4) | Google LLC | time4.google.com — Google's public leap-smeared NTP service |
129.6.15.28 | NIST Time Server (time-a-g) | NIST | time-a-g.nist.gov — US National Institute of Standards and Technology time server in Gaithersburg |
129.6.15.29 | NIST Time Server (time-b-g) | NIST | time-b-g.nist.gov — US National Institute of Standards and Technology time server in Gaithersburg |
CDN edge addresses
Addresses on content delivery networks that are frequently seen in logs and diagnostics.
| Address | Name | Operator | About |
|---|---|---|---|
13.225.0.1 | Amazon CloudFront | Amazon Web Services | AWS CloudFront CDN edge |
104.16.0.1 | Cloudflare Anycast | Cloudflare Inc | Cloudflare's primary anycast address range |
104.18.0.1 | Cloudflare Edge 2 | Cloudflare Inc | Cloudflare secondary anycast range |
151.101.0.1 | Fastly Anycast | Fastly Inc | Fastly CDN primary anycast |
199.232.0.1 | Fastly Shared SSL | Fastly Inc | Fastly shared TLS endpoint |
23.227.38.32 | Shopify CDN | Shopify Inc | Shopify CDN edge (shops.myshopify.com) |
Cloud infrastructure
Well-known service addresses inside public cloud platforms.
| Address | Name | Operator | About |
|---|---|---|---|
52.94.236.248 | AWS API Endpoint | Amazon Web Services | AWS API service endpoint (us-east-1) |
169.254.169.254 | AWS Metadata Service | Amazon Web Services | AWS instance metadata endpoint (link-local) |
35.190.247.1 | Google Cloud LB | Google LLC | Google Cloud global load balancer health check |
95.216.0.1 | Hetzner Cloud | Hetzner Online | Hetzner Cloud data center range |
20.60.0.1 | Azure Front Door | Microsoft | Azure Front Door anycast |
168.63.129.16 | Azure Metadata Service | Microsoft | Azure instance metadata and health probe endpoint |
Email infrastructure
Mail servers and anti-spam infrastructure commonly referenced in mail headers and filters.
| Address | Name | Operator | About |
|---|---|---|---|
209.85.220.41 | Gmail SMTP | Google LLC | Google Gmail outbound SMTP relay |
40.107.0.1 | Microsoft 365 SMTP | Microsoft | Microsoft 365 Exchange Online outbound |
63.35.35.35 | Trend Micro Email | Trend Micro | Trend Micro email security gateway |
Web services
Addresses of widely used public web services.
| Address | Name | Operator | About |
|---|---|---|---|
54.239.28.85 | Amazon.com | Amazon.com Inc | Amazon retail web services |
17.172.224.47 | Apple.com | Apple Inc | Apple corporate web services |
151.101.1.140 | Reddit.com | Fastly/Reddit | Reddit via Fastly CDN |
142.250.80.46 | Google.com | Google LLC | Google's primary search engine anycast |
172.217.0.1 | Google Services | Google LLC | Google services anycast range |
31.13.65.36 | Facebook.com | Meta Platforms | Meta's primary web services |
157.240.1.35 | Meta Platforms | WhatsApp messaging infrastructure | |
13.107.42.14 | Microsoft.com | Microsoft | Microsoft corporate web services |
204.79.197.200 | Bing.com | Microsoft | Microsoft Bing search engine |
140.82.121.3 | GitHub.com | Microsoft/GitHub | GitHub primary web endpoint |
199.232.69.194 | GitHub Pages | Microsoft/GitHub | GitHub Pages CDN via Fastly |
Software infrastructure
Package, update and developer infrastructure addresses.
| Address | Name | Operator | About |
|---|---|---|---|
185.125.190.56 | Ubuntu Archive | Canonical Ltd | Ubuntu package archive mirror |
Security research
Addresses associated with internet-wide measurement and research projects.
| Address | Name | Operator | About |
|---|---|---|---|
45.33.32.156 | Scanme.nmap.org | Insecure.Org | Nmap project official scan target |
Tor infrastructure
Directory authorities and other well-known Tor network infrastructure.
| Address | Name | Operator | About |
|---|---|---|---|
162.247.74.206 | Tor Exit (Calyx 2) | Calyx Institute | Tor exit node operated by Calyx Institute |
185.220.100.240 | Tor Exit (Calyx) | Calyx Institute | Major Tor exit node operated by Calyx Institute |
Why these addresses matter
Well-known addresses are useful reference points. They confirm that a lookup tool is working, appear in firewall rules and network diagnostics, and show up constantly in logs. Because they are so recognisable, they are also impersonated: a hostname or certificate claiming to be a famous resolver on an unrelated network is a warning sign. Checking an address's ownership and routing, rather than its label, is the reliable test.
See also IP ranges by provider, the network directory and the IP lookup tool.