IP to VPN Database

The IP to VPN Database is a database that contains VPN IP addresses from well-known providers like ExpressVPN and NordVPN. Additionally, the database contains IP ranges from other VPN providers from which the provider's name is not known. The database is updated on a regular basis and is available for purchase in CSV or MMDB format.

Despite the fact that VPN services bring a lot of benefits to its users, they also have a dark side. VPN services are often used by cybercriminals to hide their real IP address and to bypass geo-restrictions and commit fraud. The IP to VPN Database is a valuable tool for businesses that want to detect VPN usage on their website or app and to take appropriate measures to protect their services.

{
  "message": "Please make an API request",
}

# Purchase Database

To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file for all formats.

# VPN Database Format

The file format of the IP to VPN Database is either in CSV or MMDB format and contains the following fields:

• ipVersion - Either 4 (IPv4) or 6 (IPv6), determining the IP type of the network.
• startIp - The start IP address of the range in string format. Example: 45.86.210.31
• endIp - The end IP address of the range in string format. Example: 45.86.210.31
• serviceName - The name of the VPN provider. Example: NordVPN
• serviceUrl - The url of the VPN provider. Example: https://nordvpn.com/

The following example contains an small excerpt of the entire database:

startIp,endIp,ipVersion,serviceName,serviceUrl
5.182.32.54,5.182.32.54,4,NordVPN,https://nordvpn.com
37.19.196.4,37.19.196.4,4,NordVPN,https://nordvpn.com
185.61.158.199,185.61.158.199,4,NordVPN,https://nordvpn.com
98.159.226.103,98.159.226.103,4,ExpressVPN,https://expressvpn.com
149.88.24.4,149.88.24.4,4,ProtonVPN,https://protonvpn.com
72.14.148.23,72.14.148.23,4,ProtonVPN,https://protonvpn.com
103.209.254.131,103.209.254.131,4,IPVanish,https://ipvanish.com
193.43.135.231,193.43.135.231,4,NordVPN,https://nordvpn.com
195.206.183.201,195.206.183.201,4,NordVPN,https://nordvpn.com
193.160.101.14,193.160.101.14,4,NordVPN,https://nordvpn.com
194.110.85.24,194.110.85.24,4,NordVPN,https://nordvpn.com
194.34.233.189,194.34.233.189,4,NordVPN,https://nordvpn.com
185.225.234.214,185.225.234.214,4,NordVPN,https://nordvpn.com
103.214.45.12,103.214.45.12,4,NordVPN,https://nordvpn.com
89.163.247.130,89.163.247.130,4,VPN Unlimited,https://vpnunlimitedapp.com
216.131.118.67,216.131.118.67,4,IPVanish,https://ipvanish.com
45.85.145.144,45.85.145.144,4,NordVPN,https://nordvpn.com
149.34.242.65,149.34.242.65,4,Surfshark,https://surfshark.com
216.131.116.104,216.131.116.104,4,IPVanish,https://ipvanish.com
176.227.242.111,176.227.242.111,4,NordVPN,https://nordvpn.com
192.145.116.76,192.145.116.76,4,NordVPN,https://nordvpn.com

# How to use the IP to VPN Database?

This example shows how to work with the IP to VPN Database in MMDB format. First, you have to download the database sample:

curl -O https://ipapi.is/data/samples/VPN-Database-Sample.mmdb

And then you can read the database with mmdbctl:

mmdbctl read -f json-pretty 216.131.84.27 VPN-Database-Sample.mmdb

which outputs:

{
  "ipVersion": "4",
  "network": "216.131.84.27-216.131.84.27",
  "serviceName": "IPVanish",
  "serviceUrl": "https://ipvanish.com"
}

# Why is VPN Detection Important?

VPN detection is the process of finding out whether an arbitrary IP address belongs to a VPN service and to which VPN provider it belongs (Such as IPVanish or HideMyAss). It is important to understand that the true IP address of the VPN user cannot be revealed.

There are many good reasons why websites or apps want to detect users with a VPN enabled:

• VPN users bypass geo-restricted content by connecting to a VPN in a different country.
• VPN users committing cybercrime cannot be easily identified - the VPN is protecting the bad guys as well!
• A VPN service allows a single entity to obtain access to hundreds of different IP addresses from different countries and thus to bypass rate limits. Therefore, VPN usage is also associated with bot attacks and automated threats.
• VPN usage can mask real user locations, enabling fraudulent activities such as credit card fraud or unauthorized account access. Detecting VPN usage helps businesses implement additional security measures to reduce the risk of fraud.
• VPNs can give users an unfair advantage in online services, such as in the survey, gaming or ticket purchasing industry.

Examples

Online Survey Industry: VPN usage distorts YouGov's survey results by allowing users outside the targeted regions to participate, leading to inaccurate data about local opinions and demographics. Fraudsters are incentivized to participate in online surveys because each completed survey is paid. A survey completed by a citizen of Switzerland is more expensive than a survey completed by a citizen of an economically poorer region of the world. By using a VPN, a fraudster can pretend to be a Swiss citizen and earn more money per survey.

Public Broadcasting and Media: The BBC iPlayer is only intended to be used for users in the UK. Therefore, BBC disallows any user that is not located in the UK. By using a VPN server located in the UK, it is possible to bypass this geo-restriction and use the BBC iPlayer from anywhere in the world.

Since BBC likely knows that their geo-restriction is bypassed by some cunning VPN users, they have a justified reason to disallow VPN users from accessing their streaming service. This explains why there is a legitimate interest in knowing whether an Internet user is hiding behind a VPN server or not.

# How does VPN Detection Work?

There are several methods to detect VPN usage. At ipapi.is, the following two VPN detection methods are currently used:

• VPN Exit Node Enumeration: This method consists of purchasing VPN subscriptions from commercial VPN providers and then connecting to different regions while grabbing the Exit Node IP address.
• Statistical Inference and Data Analysis: By correlation and statistical inference methods, it is possible to derive new VPN IP ranges. This method only works if the ground truth data is false positive free (Which is the case with VPN Exit Node Enumeration)

The idea behind VPN Exit Node Enumeration is very simple: A paid plan from each VPN provider is purchased. Then, the VPN client application of each provider is installed, a connection to each region of each provider is made and the VPN exit node IP address is gathered. Most VPN providers allow their users to connect to all their available regions, but some of the providers might throttle the amount of reconnections per time span.

Put differently, this detection method works by enumerating all available regions, connecting to each region and storing the VPN IP address by using tools such as ipapi.is to get the public IP address.

The hardest part of VPN exit node enumeration is to automate the process of rotating the VPN region automatically. Most commercial providers such as NordVPN or ExpressVPN do not make it easy to rotate the region automatically. Nevertheless, automation is certainly possibly for every provider, it just takes a bit longer.

The biggest advantage of this VPN detection method is the certainty that each obtained IP address actually belongs to the VPN provider. False positives are virtually impossible.

Furthermore, this detection method is the only one that allows to reliably distinguish to which VPN provider the IP address actually belongs, since it is known at all times which service is used.