IP to VPN Database
IP to VPN Database
VPN Detection
VPN Exit Node Enumeration
The IP to VPN Database is a database that contains VPN
IP addresses from
well-known providers like
ExpressVPN and
NordVPN. Additionally, the database contains IP ranges from other VPN
providers from which the provider's name is not known. The database is updated on a regular basis and is
available for purchase in CSV or MMDB format.
Despite the fact that VPN services bring a lot of benefits to its users, they also have a dark side.
VPN services are often used by cybercriminals to hide their real IP address and to bypass geo-restrictions
and commit fraud.
The IP to VPN Database is a valuable tool for businesses that want to detect VPN usage on their website or
app and to take appropriate measures to protect their services.
IP to VPN Database
Price
59$ per month
Filesize
2.0M
Format
CSV and MMDB
Total VPN IPs
284,229,039
IPs with known VPN Provider
56,702
Last Updated
October 14, 2024
#
Purchase Database
To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be
canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file
for all formats.
The file format of the IP to VPN Database is either in CSV or MMDB format and contains the following fields:
ipVersion
- Either 4
(IPv4) or 6
(IPv6), determining
the IP type of the network.
startIp
- The start IP address of the range in string format. Example:
45.86.210.31
endIp
- The end IP address of the range in string format. Example:
45.86.210.31
serviceName
- The name of the VPN provider. Example:
NordVPN
serviceUrl
- The url of the VPN provider. Example:
https://nordvpn.com/
The
following example contains an small excerpt of the
entire database:
startIp,endIp,ipVersion,serviceName,serviceUrl
5.182.32.54,5.182.32.54,4,NordVPN,https://nordvpn.com
37.19.196.4,37.19.196.4,4,NordVPN,https://nordvpn.com
185.61.158.199,185.61.158.199,4,NordVPN,https://nordvpn.com
98.159.226.103,98.159.226.103,4,ExpressVPN,https://expressvpn.com
149.88.24.4,149.88.24.4,4,ProtonVPN,https://protonvpn.com
72.14.148.23,72.14.148.23,4,ProtonVPN,https://protonvpn.com
103.209.254.131,103.209.254.131,4,IPVanish,https://ipvanish.com
193.43.135.231,193.43.135.231,4,NordVPN,https://nordvpn.com
195.206.183.201,195.206.183.201,4,NordVPN,https://nordvpn.com
193.160.101.14,193.160.101.14,4,NordVPN,https://nordvpn.com
194.110.85.24,194.110.85.24,4,NordVPN,https://nordvpn.com
194.34.233.189,194.34.233.189,4,NordVPN,https://nordvpn.com
185.225.234.214,185.225.234.214,4,NordVPN,https://nordvpn.com
103.214.45.12,103.214.45.12,4,NordVPN,https://nordvpn.com
89.163.247.130,89.163.247.130,4,VPN Unlimited,https://vpnunlimitedapp.com
216.131.118.67,216.131.118.67,4,IPVanish,https://ipvanish.com
45.85.145.144,45.85.145.144,4,NordVPN,https://nordvpn.com
149.34.242.65,149.34.242.65,4,Surfshark,https://surfshark.com
216.131.116.104,216.131.116.104,4,IPVanish,https://ipvanish.com
176.227.242.111,176.227.242.111,4,NordVPN,https://nordvpn.com
192.145.116.76,192.145.116.76,4,NordVPN,https://nordvpn.com
#
How to use the IP to VPN Database?
This example shows how to work with the IP to VPN Database in MMDB format. First, you have to download the
database sample:
curl -O https://ipapi.is/data/samples/VPN-Database-Sample.mmdb
And then you can read the database with mmdbctl:
mmdbctl read -f json-pretty 216.131.84.27 VPN-Database-Sample.mmdb
which outputs:
{
"ipVersion": "4",
"network": "216.131.84.27-216.131.84.27",
"serviceName": "IPVanish",
"serviceUrl": "https://ipvanish.com"
}
#
Why is VPN Detection Important?
VPN detection is the process of finding out whether an arbitrary IP address belongs to a VPN service and
to which VPN provider it belongs (Such as IPVanish or HideMyAss). It is important to understand that the true
IP
address of the VPN user cannot be revealed.
The IP to VPN Database includes
information about VPN IP addresses. With static methods such as databases, it is not possible to reveal the
real IP address of a client that is using a VPN service.
There are many good reasons why websites or apps want to detect users with a VPN
enabled:
- VPN users bypass geo-restricted content by connecting to a VPN in a different country.
- VPN users committing cybercrime cannot be easily identified - the VPN is protecting the bad guys as
well!
- A VPN service allows a single entity to obtain access to hundreds of different IP addresses from
different countries and thus to bypass rate limits. Therefore, VPN usage is also associated with bot
attacks and
automated threats.
- VPN usage can mask real user locations, enabling fraudulent activities such as credit card fraud or
unauthorized account access. Detecting VPN usage helps businesses implement additional security measures
to reduce the risk of fraud.
- VPNs can give users an unfair advantage in online services, such as in the survey, gaming or ticket
purchasing industry.
Examples
Online Survey Industry: VPN usage distorts YouGov's
survey
results by allowing users outside the
targeted regions to participate, leading to inaccurate data about local opinions and demographics.
Fraudsters are incentivized to participate in online surveys because each completed survey is paid. A survey
completed by a citizen of Switzerland is more expensive than a survey completed by a citizen of an
economically poorer region of the world. By using a VPN, a fraudster can pretend to be a Swiss citizen and
earn more money per survey.
Public Broadcasting and Media: The BBC iPlayer
is only
intended to be used
for
users
in the UK. Therefore, BBC disallows any user that is not located in the UK.
By using a VPN server located in the UK, it is possible to bypass this geo-restriction and use the BBC iPlayer from anywhere in
the world.
Since BBC likely knows
that their geo-restriction is bypassed by some cunning VPN users, they have a justified reason to
disallow
VPN users from accessing their streaming service. This
explains why there is a legitimate interest in knowing whether an Internet user is hiding behind a VPN
server or not.
#
How does VPN Detection Work?
There are several methods to detect VPN usage. At ipapi.is, the following two VPN detection methods are
currently used:
- VPN Exit Node Enumeration: This method consists of purchasing VPN subscriptions from
commercial VPN providers and
then
connecting to
different regions while grabbing the Exit Node IP address.
- Statistical Inference and Data Analysis: By correlation and statistical inference
methods, it is possible to derive new VPN IP ranges. This method only
works if the ground truth data is false positive free (Which is the case with VPN Exit Node Enumeration)
The idea behind VPN Exit Node Enumeration is very simple: A paid
plan from each
VPN provider is purchased. Then, the VPN client application of each provider
is installed, a connection to each region of each provider is made and the VPN exit node IP address is
gathered. Most VPN
providers
allow their users to connect to all
their available regions, but some of the providers might throttle the amount of reconnections per time
span.
Put differently, this detection method works by enumerating all available regions, connecting to each
region and storing the VPN IP address by using tools such as ipapi.is to
get the public IP address.
The hardest part of VPN exit node enumeration is to automate the process of rotating the VPN region
automatically. Most commercial providers such as NordVPN or ExpressVPN do not make it easy to rotate the region
automatically. Nevertheless, automation is certainly possibly for every provider, it just takes a bit
longer.
The biggest advantage of this VPN detection method is the certainty that each obtained IP address
actually belongs to the VPN provider. False positives are virtually impossible.
Furthermore, this detection method is the only one that allows to reliably distinguish to which VPN
provider the IP address actually belongs, since it is known at all times which service is used.
Read more about VPN Detection