VPN IP Database & VPN Detection

The IP to VPN Database tells you whether an IP address belongs to a VPN service, and to which one. Its core are 393,522 exit node IP addresses of 73 VPN services such as NordVPN, ExpressVPN, Mullvad, Surfshark and ProtonVPN, which we observe ourselves by connecting to their servers around the clock. VPN ranges inferred from these exit nodes extend the coverage, and a list of open proxies is included. Detect VPN users where it matters: at checkout, at signup, in a survey or in front of licensed content.

• Exit nodes with the VPN service's name, the server's location and hostname, and when we last saw them
• Virtual locations: where a service claims a server is, next to where it really is
• Three datasets from precise to wide, so you choose between precision and coverage
• Open and public proxies, in a separate file
• Rebuilt every day, IPv4 and IPv6, in CSV and MMDB format
• The same data as the is_vpn field and the vpn object of the ipapi.is API

{
  "ip": "45.13.191.194",
  "service": "ExpressVPN",
  "url": "https://expressvpn.com",
  "type": "exit_node",
  "last_seen": 1794579890080,
  "last_seen_str": "2026-11-13T14:24:50.080Z",
  "exit_node_region": "Norway",
  "country_code": "NO",
  "city_name": "Oslo",
  "latitude": 59.91273,
  "longitude": 10.74609
}

# Use Cases

A VPN hides where a user really is and lets one person appear as many. Most VPN users only want privacy, but the same tools serve fraudsters, bots and people who bypass rules that depend on location:

# Purchase Database

Create a free account, subscribe in your dashboard with a card or PayPal, and download the database right away, in every format it comes in. The subscription is billed monthly and can be canceled at any time. Updates are included: your personal download link always serves the latest release, so one scheduled command keeps your copy current. See pricing and the terms.

Need more than one database? The Business plan includes all seven databases ($563 per month if bought separately), the largest standard API plan and the right to run the API on your own servers, for $200 per month.

# The Three Datasets

The IP to VPN Database consists of three datasets with different methods, from precise to wide. Use only the first where a wrong decision is expensive, and all three where you only score. No VPN database is complete: providers add servers every day.

#enumerated-vpn: confirmed exit nodes

The most precise dataset. We connect to the servers of the VPN services ourselves and record the public IP address each one gives us: the exit node, which is the address websites see when someone uses the VPN. These records have the exitNodeType exit_node. The dataset also contains the addresses of VPN servers listed in the services' own server configurations (vpn_server), and ranges the services publish themselves, for example in their geofeeds.

Every record names its VPN service, and most have the location of the exit node, its hostname and region label. An exit node that is not seen again is removed after at most 45 days, usually much sooner, so the dataset follows the services' current infrastructure.

#interpolated-vpn: VPN networks inferred from exit nodes

VPN services run their exit servers in contiguous blocks of addresses. A block in which many addresses are confirmed exit nodes of one service is therefore that service's block in full, including the addresses we have not connected to yet. This dataset groups the confirmed exit nodes by the address assignment that holds them and publishes the largest blocks with enough independent exit nodes at a high enough density. Blocks of consumer ISPs, mobile carriers, universities and banks must clear a much higher bar, because a single exit node there is usually a subscriber running a VPN client.

Networks with exit nodes of several services are included, with every service named. Measured against confirmed exit nodes held back from the method, this dataset finds about 80% of them, and under 0.1% of the addresses it publishes appear in data that contradicts a VPN.

#assumed-vpn: assumed VPN ranges

Ranges assumed to belong to VPN services, from WHOIS records that describe VPN or proxy infrastructure and from blocks that carry confirmed exit nodes, but not densely or purely enough for interpolated-vpn. Address space of end-user networks is excluded entirely. This dataset maximizes coverage and is not free of false positives: use it for scoring rather than blocking.

# Database Format

Each dataset is one file in CSV and MMDB format, with IPv4 and IPv6 records in the same file. Each record covers the range from startIp to endIp. The enumerated-vpn file has these columns; empty fields mean the value is not known:

The interpolated-vpn file has the columns startIp, endIp, ipVersion, serviceName and serviceUrl; for a network shared by several services, serviceName lists all of them. The assumed-vpn file and the proxy file with the open proxies have startIp, endIp, ipVersion and a flag that is always true (isVpn or isProxy). sharedVpnNetworks.json lists the networks shared by several VPN services, with the number of confirmed exit nodes of each.

An excerpt of the enumerated-vpn CSV file:

startIp,endIp,ipVersion,serviceName,serviceUrl,exitNodeType,lastSeen,lastSeenStr,exitNodeRegion,hostname,countryCode,cityName,latitude,longitude,claimedCountryCode,claimedCityName,claimedLatitude,claimedLongitude
45.132.224.95,45.132.224.95,4,ExpressVPN,https://expressvpn.com,exit_node,1794579890080,2026-11-13T14:24:50.080Z,Australia - Brisbane,,AU,Brisbane,-27.46794,153.02809,,,,
187.13.20.17,187.13.20.17,4,NordVPN,https://nordvpn.com,exit_node,1794578680979,2026-11-13T14:04:40.979Z,Australia #1102,,AU,Brisbane,-27.47101,153.024292,,,,
185.156.46.138,185.156.46.138,4,MullvadVPN,https://mullvad.net,exit_node,1794498419052,2026-11-12T15:46:59.052Z,us-qas-wg-101,,US,Ashburn,39.04372,-77.48749,,,,
79.135.104.51,79.135.104.51,4,ProtonVPN,https://protonvpn.com,exit_node,1794581976845,2026-11-13T14:59:36.845Z,"Paris, FR",node-fr-24.protonvpn.net,FR,Paris,48.86,2.35,,,,
151.240.56.109,151.240.56.109,4,Private Internet Access,https://privateinternetaccess.com,exit_node,1794577592416,2026-11-13T13:46:32.416Z,us_south_carolina-pf,,US,Charleston,32.77632,-79.93275,,,,
187.188.63.210,187.188.63.210,4,Mysterium,https://mysterium.network,exit_node,1794552555833,2026-11-13T06:49:15.833Z,0x6d6f8a93c8b0e5cca83ab1829240291a4c3ff182,,MX,Guadalajara,20.67738,-103.34749,,,,
146.70.9.233,146.70.9.233,4,Windscribe,https://windscribe.com,exit_node,1794544437514,2026-11-13T04:33:57.514Z,Windscribe-Hong-Kong-Victoria,,HK,Hong Kong,22.29,114.16,,,,
193.238.152.246,193.238.152.246,4,X-VPN,https://xvpn.io,exit_node,1794543387988,2026-11-13T04:16:27.988Z,Ukraine,,UA,Kyiv,50.45466,30.5238,,,,
45.139.253.21,45.139.253.21,4,Surfshark,https://surfshark.com,exit_node,1794467848707,2026-11-12T07:17:28.707Z,pr-sju.prod.surfshark.com_udp.ovpn,,PR,san juan,18.46633,-66.10572,,,,
64.145.91.141,64.145.91.141,4,Bitdefender VPN,https://www.bitdefender.com/solutions/vpn.html,exit_node,1794383492192,2026-11-11T07:51:32.192Z,Kazakhstan,,KZ,Astana,51.1876,71.4491,,,,
109.74.198.50,109.74.198.50,4,Speedify,https://speedify.com,exit_node,1794377515314,2026-11-11T06:11:55.314Z,gb-london-48,,GB,London,51.50853,-0.12574,,,,
54.159.155.65,54.159.155.65,4,Avast VPN,https://www.avast.com/secureline-vpn,exit_node,1794277491685,2026-11-10T02:24:51.685Z,United States - Ashburn,,US,Ashburn,39.04372,-77.48749,,,,

# How to Use the IP to VPN Database

Download the MMDB sample:

curl -O https://ipapi.is/data/samples/Enumerated-VPN-Database-Sample.mmdb

Look up an IP address with mmdbctl:

mmdbctl read -f json-pretty 45.132.224.95 Enumerated-VPN-Database-Sample.mmdb

which outputs:

{
  "cityName": "Brisbane",
  "claimedCityName": "",
  "claimedCountryCode": "",
  "claimedLatitude": "",
  "claimedLongitude": "",
  "countryCode": "AU",
  "exitNodeRegion": "Australia - Brisbane",
  "exitNodeType": "exit_node",
  "hostname": "",
  "ip": "45.132.224.95",
  "ipVersion": "4",
  "lastSeen": "1794579890080",
  "lastSeenStr": "2026-11-13T14:24:50.080Z",
  "latitude": "-27.46794",
  "longitude": "153.02809",
  "network": "45.132.224.95-45.132.224.95",
  "serviceName": "ExpressVPN",
  "serviceUrl": "https://expressvpn.com"
}

The MMDB format can be read by the MaxMind DB reader library of every major programming language. In Python:

import maxminddb  # pip install maxminddb

reader = maxminddb.open_database('Enumerated-VPN-Database-Sample.mmdb')
record = reader.get('203.0.113.7')
if record:
    print('VPN exit node of', record['serviceName'])
else:
    print('Not a known VPN exit node')

# How VPN Detection Works

A VPN user's traffic leaves the VPN at an exit node, and websites see the exit node's IP address instead of the user's. To recognize VPN traffic, you need to know the exit nodes. The most reliable way to find them is to use the VPN services, which is what we do:

• Exit node enumeration: we subscribe to commercial VPN services and connect to their servers and regions around the clock, with their desktop apps, command-line clients and configuration files, and record the public IP address every connection gets. Because we know which service we are connected to, every exit node is attributed to its provider.
• Inference: the confirmed exit nodes reveal the address blocks the services operate (see interpolated-vpn above). This works only because the ground truth is precise.
• Published data: server lists and geofeeds that VPN services publish, and the reverse DNS names from our crawl of every IPv4 address, add servers we have not connected to yet.

Automating hundreds of connections a day is the hard part: most VPN apps are not built to switch regions without a person clicking. Our article on systematic VPN detection describes how it is done. A list of recently seen exit nodes, by provider, is on the VPN exit nodes page.

# Frequently Asked Questions

# More IP Databases

All seven databases are also part of the Business plan, together with the API.