GitHub Actions

What it is

The ranges GitHub's hosted CI runners connect from, the `actions` member of GitHub's meta endpoint. A signup or a scrape from a workflow is infrastructure with a named operator, so it reads as GitHub Actions rather than as a visitor; the runners live inside Azure's ranges and the more specific name wins.

What it answers

In the IP response this source feeds is_datacenter, hosting_provider, connection_type. Every answer names the datasets it read in its sources block with the date each was synced, so the figure on this page and the one in an answer are the same figure.

curl https://spaw.co/api/v1/ip \
  -H "Authorization: Bearer $SPAW_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip": "203.0.113.9"}'

How to read this page

A source names a network or an operator, never a person. An address inside one of these ranges tells you what the connection is — a cloud instance, a VPN exit, a gateway, a listed host — and nothing about who is behind it.

This page is a reference about detection, not a mirror of the operator's list: it prints counts and dates, not addresses. The operator publishes the list itself, at the address above, and is the place to read it.

More sources in clouds and hosting

• Amazon Web Services
• Google Cloud
• Microsoft Azure
• Oracle Cloud
• DigitalOcean
• Linode
• Vultr
• Cloudflare
• Fastly
• Every source
• Every field, documented
• Look up an address

counts and dates read from the installed feed · checked 2026-09-13