Cloudflare WARP

What it is

Cloudflare publishes no list of the egress addresses of WARP, its consumer VPN, which also powers Microsoft Edge Secure Network. WARP is therefore inferred: Cloudflare's own autonomous system outside the CDN ranges it does publish and outside the public resolvers. An inference can only say yes, so it never produces a checked negative, and the answer says so in the service name.

What it answers

In the IP response this source feeds is_vpn, privacy_service, is_anonymous. Every answer names the datasets it read in its sources block with the date each was synced, so the figure on this page and the one in an answer are the same figure.

curl https://spaw.co/api/v1/ip \
  -H "Authorization: Bearer $SPAW_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip": "203.0.113.9"}'

How to read this page

A source names a network or an operator, never a person. An address inside one of these ranges tells you what the connection is — a cloud instance, a VPN exit, a gateway, a listed host — and nothing about who is behind it.

This page is a reference about detection, not a mirror of the operator's list: it prints counts and dates, not addresses. The operator publishes the list itself, at the address above, and is the place to read it.

An inference is not a list. It can only say yes: where it does not match, the flag stays whatever the published lists made it, and the answer marks the service name as inferred so nobody mistakes it for a publisher's own statement.

More sources in vpn and relay

• Mullvad
• NordVPN
• Private Internet Access
• IVPN
• AirVPN
• VPN Gate
• iCloud Private Relay
• Every source
• Every field, documented
• Look up an address

counts and dates read from the installed feed · checked 2026-09-13