IP to Hosting Database
The IP to Hosting Database is a database in CSV or MMDB format that contains all known hosting / cloud IP ranges of the Internet. The database is continuously updated and new hosting / cloud IP ranges are added as soon as they emerge. The database considers IP ranges from all of the following service types as hosting IP ranges:
- Normal hosting providers such as Hetzner.de or Leaseweb.com
- Large cloud providers such as Amazon AWS or Microsoft Azure
- Content Delivery Networks such as Cloudflare, Fastly or edg.io
- Anti-DDOS services such as qrator.net or ddos-guard.net
- IP leasing organizations such as ipxo.com or interlir.com
- Other SaaS, IaaS, or PaaS organizations such as fly.io or Heroku
For many IT security applications, it is essential to know whether an IP address belongs to a hosting provider. A substantial part of the malicious traffic in the Internet originates from hosting IP ranges. Examples of malicious traffic that you want to block is: Scanning activity, scraping, crawling, traffic from VPN or Proxy servers, automated attack traffic and so on.
IPv4 to Hosting Database
IPv6 to Hosting Database
Demo for IP to Hosting Database
Enter any IP address to obtain the ip to hosting data associated with this IP address.
{
"message": "Please make an API request",
}# Purchase Database
To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file for all formats.
# Hosting Database Format
The file format of the IP to Hosting Database is in CSV or MMDB format and contains the following fields:
ip_version- Either4(IPv4) or6(IPv6), determining the IP type of the network.startIp- The start IP address of the range in string format. Example:45.59.132.0endIp- The end IP address of the range in string format. Example:45.59.135.255datacenter- The name of the hosting / cloud provider. Example:PureVoltage Hosting Inc.domain- The domain name of the hosting / cloud provider. Example:purevoltage.com
The following CSV example contains an small excerpt of the entire database:
# How to use the IP to Hosting Database?
This example shows how to work with the IP to Hosting Database in MMDB format.
curl -O https://ipapi.is/data/samples/HostingRangesIPv4-Sample.mmdbAnd parse with mmdbctl:
mmdbctl read -f json-pretty 5.9.15.160 HostingRangesIPv4-Sample.mmdbwhich outputs:
{
"datacenter": "Hetzner Online GmbH",
"domain": "hetzner.com",
"ipVersion": "4",
"network": "5.9.15.160-5.9.15.167"
}
# What is Hosting Detection?
Ipapi.is strongly emphasizes Hosting Detection. Hosting detection is the process of determining whether an IP address belongs to a hosting provider. Knowing whether an IP address is associated with a hosting or cloud provider carries significant IT security implications, since a lot of malicious traffic in the Internet originates from hosting IP ranges. A sophisticated hosting detection algorithm was developed to identify thousands of new and lesser-known hosting providers across the entire Internet.
Information on whether an IP address belongs to a hosting provider is displayed directly in the API output
in the is_datacenter field. For example, the following IP addresses are all associated with
hosting or cloud providers:
- 94.130.228.239 - Hetzner Online GmbH
- 156.224.19.121 - Arosscloud INC
- 149.88.110.171 - Datacamp Limited
- 217.182.121.212 - Raiola Networks SL
- 45.79.150.128 - Linode
Click on the button below in order to view all currently tracked hosting providers:
# How does Hosting Detection Work?
Each IP address in the Internet is owned or administered by an organization or institute. This organization can be privately owned or part of a nonprofit organization. Regional Internet Registries (RIRs) such as ARIN, RIPE NCC, or APNIC store this information in WHOIS databases.
Therefore, it is possible to map each IP address on the Internet to its administrative organization. The next step is to determine whether this organization is a hosting provider or not. This step is particularly challenging since WHOIS information does not directly include this detail. Often, WHOIS records only contain the bare minimum of information about organizations for privacy reasons.
Most WHOIS databases store IP ranges in NetRange or inetnum objects. These objects
are usually linked to an organization name. Based on this linked organization name, a hosting provider
classification must be made. Any other approach leads to the problem that the corresponding IP ranges are
hard to identify. Put differently: The organization name from WHOIS records can only be extracted in such a
way that a direct correlation to the IP range remains intact. Otherwise, IP ranges couldn't be classified.
Several different strategies are pursued in order to determine if an organization is a hosting provider or not:
- The least efficient method is to manually label organizations as hosting providers. This is practically impossible, since the Internet is constantly evolving and manually labeling hundreds of thousands of organizations is not an efficient process.
- A more efficient method is to automatically label organizations as hosting providers based on metadata such as organization name, organization domain, organization website with HTML text and HTML meta tags as input. For this purpose, ipapi.is constantly monitors websites of all major network-owning organizations of the Internet. This requires crawling hundreds of thousands of websites on a monthly basis. The hosting detection algorithm is described in a dedicated blog article.
- Many large hosting providers publish their IP ranges on their website. Hundreds of such feeds are used. Examples:
- Another approach is to consider the work of open-source projects that attempt to find hosting IP addresses. Examples of such projects are:
By employing the above strategies, thousands of hosting providers and their IP networks are tracked. This data collection and data labeling process is time-consuming and is prone to false positives. ipapi.is focuses on false positive reduction and provides the most comprehensive hosting provider database on the Internet.
# Why is Hosting Detection important?
Often, hosting providers allow their clients to purchase computing and networking resources without providing any form of identification. Those resources are often abused for the following malicious purposes:
- Hosting VPN and proxy servers
- Scanning and crawling software
- Malware and viruses
- Bots and Crawlers
- VNC or Remote Desktop Servers
Hosting providers can give cybercriminals the necessary infrastructure to launch attacks on the Internet. Knowing whether an IP address belongs to a hosting provider is therefore essential for security purposes. As a general rule of thumb, there is no good reason to allow traffic on your website or app to originate from hosting IP ranges, since normal end users browse the Internet from their home or office IP (ISP and Business IP ranges).
# IP to Hosting Package (npm)
The ip-to-hosting npm package gives you an accurate tool to determine if an IP address belongs
to a hosting
provider or not.
# List of Hosting Providers
The table below lists the top 2000 hosting providers of the Internet.