Hosting Provider Detection

# Introduction

ipapi.is strongly emphasizes hosting detection. Hosting detection is the process of deciding whether an IP address belongs to a hosting provider or not. Knowing whether an IP address is associated with a hosting or cloud provider has many IT security implications. A complicated hosting detection algorithm was developed to detect thousands of new and lesser known hosting providers throughout the entire Internet.

The information whether an IP address belongs to a hosting provider is displayed directly in the API output in the is_datacenter field. For example, the following IP addresses all belong to hosting or cloud providers:

• 94.130.228.239
• 91.106.210.70
• 54.38.74.141

Click on the button below in order to view all currently tracked hosting providers:

# How does Hosting Detection work?

Each IP address in the Internet is owned or administered by an organization. Regional Internet Registries (RIR's) such as ARIN or APNIC store this information in their WHOIS databases. Therefore, it is possible to map each IP address in the Internet to its administrative organization. The next step is to decide whether this organization is a hosting provider or not. This step is particularly challenging, since the WHOIS information does not include this information directly. Often, WHOIS records only contain the bare minimum of information for privacy reasons.

It is important to classify organizations in the form they are represented in WHOIS records as hosting providers, since this is the only way how their corresponding IP ranges can be located. Put differently: WHOIS databases store IP ranges in NetRange or inetnum objects. Those objects are usually linked to an organization name. Based on this linked organization name, a classification must be made. Any other approach leads to the problem that the corresponding IP ranges are hard to locate.

Several different strategies are pursued in order to determine if an organization is a hosting provider or not:

• The least efficient method is to manually label organizations as hosting providers. This is practically impossible, since the Internet is constantly evolving and manually labelling hundred thousands of organizations is not possible.
• A more efficient method is to automatically label organizations as hosting providers based on meta data such as organization name, organization domain, organization website with HTML text and HTML meta tags as input. For this purpose, ipapi.is constantly monitors websites of all major network-owning organizations of the Internet. This requires to crawl hundred thousands of websites on a monthly basis. The hosting detection algorithm is described in a dedicated blog article.
• Many large hosting providers publish their IP ranges on their website. Hundreds of such feeds are used. Examples:
  • Google Cloud IP Ranges
  • Azure IP Ranges
  • Amazon AWS IP Ranges
  • DigitalOcean IP Ranges
  • Linode IP Ranges
• Another approach is to consider the work of open source projects that attempt to find hosting IP addresses. Examples of such projects are:
  • github.com/client9/ipcat
  • github.com/Umkus/ip-index
  • github.com/X4BNet/lists_vpn

By using the above strategies, thousands of hosting providers and their networks are tracked. This data collection and data labelling process is time consuming and is prone to false positives. ipapi.is focuses on false positive reduction.

# Why is Hosting Detection important?

Hosting providers allow their clients to purchase computing and networking resources without providing any form of identification. Those resources are often abused for the following malicious purposes:

• Hosting VPN and proxy servers
• Scanning and crawling software
• Malware and viruses
• Bots
• VNC or Remote Desktop Servers

Hosting providers can give cyber criminals the necessary infrastructure to launch attacks in the Internet. Knowing whether an IP address belongs to a hosting provider is therefore essential for security purposes. As a general rule of thumb, there is no good reason to allow traffic on your website or app to originate from hosting IP ranges.

# Download Hosting IP Ranges

Click on the button below to download a database of hosting and datacenter IP ranges. The database is continuously updated and includes all known hosting IP ranges of the Internet.

• Number of Networks in the Hosting Database: 425,121
• Number of distinctly tracked Hosting Providers: 7,458

# Hosting Database Format

The file format of the database is tab separated text file (TSV), where each line of the file contains the company, network and domain of the hosting provider. In order to learn how to download & parse the database, read the documentation. The following example contains an small excerpt of the entire database:

VPS GURU CHILE SPA	45.173.128.0/22	vpshome.xyz
Google Brasil Internet Ltda	179.124.224.0/26	cloud.google.com
SERVICIO DI TELECOMUNICACION DI ARUBA (SETAR) N.V.	190.12.224.0/19	www.aruba.it
HUAWEI TECH INVESTMENT CO LTD	2803:1ae0::/32	www.huaweicloud.com
LOCAWEB SERVICOS DE INTERNET S.A.	177.70.224.0/20	www.locaweb.com.br
LOCAWEB SERVICOS DE INTERNET S.A.	177.136.16.0/20	www.locaweb.com.br
SERVICIO DI TELECOMUNICACION DI ARUBA (SETAR) N.V.	186.96.240.0/21	www.aruba.it
WAVENET S.A.	2803:c060::/32	www.wavenetuk.com
TECNOERA-WEBHOSTING	190.113.0.0/24	www.webhosting.fm
GIGAS HOSTING COLOMBIA S.A.S.	2803:31a0::/32	gigas.com
PACKETHUB S.A.	2803:4710::/32	www.packethub.net
WEBHOSTING S.R.L.	2803:29a0::/32	www.webhosting.fm
GIGAS HOSTING	138.121.168.0/22	gigas.com
INFORMATICA BLUEHOSTING LIMITADA	45.236.128.0/22	www.bluehosting.cl
CLARANET TECHNOLOGY S.A.	45.236.76.0/22	www.claranet.com
SERVICIO DI TELECOMUNICACION DI ARUBA (SETAR) N.V.	2800:ad0::/32	www.aruba.it
GIGAS HOSTING COLOMBIA S.A.S.	170.239.154.0/23	gigas.com
IPXO Ltd	200.26.184.0/22	www.ipxo.com
Locaweb Serviços de Internet S/A	186.202.0.0/16	www.locaweb.com.br
SERVICIO DI TELECOMUNICACION DI ARUBA (SETAR) N.V.	201.229.64.0/18	www.aruba.it
Huawei do Brasil Telecomunicações Ltda.	2801:80:1a30::/48	www.huaweicloud.com
SERVICIO DI TELECOMUNICACION DI ARUBA (SETAR) N.V.	186.96.200.0/21	www.aruba.it
GIGAS HOSTING COLOMBIA S.A.S.	45.163.30.0/24	gigas.com
Locaweb Serviços de Internet S/A	201.76.32.0/19	www.locaweb.com.br
GIGAS HOSTING	2803:db80::/32	gigas.com
LOCAWEB SERVICOS DE INTERNET S.A.	179.109.224.0/19	www.locaweb.com.br
SERVICIO DI TELECOMUNICACION DI ARUBA (SETAR) N.V.	186.189.0.0/18	www.aruba.it
LOCAWEB SERVICOS DE INTERNET S.A.	177.136.48.0/20	www.locaweb.com.br
Huawei do Brasil Telecomunicações Ltda.	168.195.92.0/22	www.huaweicloud.com
DIMENOC SERVICOS DE INFORMATICA LTDA	187.45.176.0/20	dimenoc.com
CLARANET TECHNOLOGY S.A.	2804:4de4::/32	www.claranet.com
Locaweb Serviços de Internet S/A	187.45.224.0/19	www.locaweb.com.br
HostDime.com.mx S.A. de C.V.	143.255.56.0/22	www.hostdime.com
GIGAS HOSTING	170.239.152.0/23	gigas.com
GIGAS HOSTING	168.232.32.0/22	gigas.com
Tierranet S.A.S.	45.182.41.0/24	www.tierra.net

# List of Hosting Providers

The table below lists the top 5000 hosting providers of the Internet.