Comment by teejmya

Found the list! It might be worth checking if your suspect traffic is from any of these subnets: https://mask-api.icloud.com/egress-ip-ranges.csv