IP to VPN Database
IP to VPN Database
VPN Detection
VPN Exit Node Enumeration
The IP to VPN Database is a database that contains VPN
IP addresses from
well-known providers like
ExpressVPN and
NordVPN. Additionally, the database contains IP ranges from other VPN
providers from which the provider's name is not known. The database is updated on a regular basis and is
available for purchase in CSV or MMDB format.
Despite the fact that VPN services bring a lot of benefits to its users, they also have a dark side.
VPN services are often used by cybercriminals to hide their real IP address and to bypass geo-restrictions
and commit fraud.
The IP to VPN Database is a valuable tool for anyone that wants to detect VPN usage on their website or
app and to take appropriate measures to protect their services.
IP to VPN Database
Price
79$ per month
Filesize
8.7MB
, 88K
, 1.3MB
Format
CSV and MMDB
Num IPs in enumerated-vpn
84,911
Num IPs in interpolated-vpn
850,167
Num IPs in assumed-vpn
333,756,144
Last Updated
December 20, 2024
The following table shows the number of unique VPN IP addresses in the
enumerated-vpn
dataset for each VPN service.
#
Purchase Database
To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be
canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file
for all formats.
#
VPN Database Datasets
The IP to VPN Database contains three different datasets with different detection accuracy and different
false positive rates. All datasets have false negatives, meaning that they are not 100% complete in
detecting all VPN IPs that exist in the world. It needs to be noted that no commercial VPN detection
service is 100% accurate in detecting all VPN IPs.
enumerated-vpn.csv
- VPN IPs detected by Exit Node Enumeration
interpolated-vpn.csv
- VPN IPs detected by Interpolation, using the
enumerated-vpn.csv
dataset as ground truth
assumed-vpn.csv
- Assumed VPN IP addresses, contains lots of false positives and must be
used
with caution
#enumerated-vpn.csv
- VPN IPs detected by Exit Node Enumeration
This is the most accurate dataset and is based on the detection of VPN Exit Nodes by systematic and
automatic enumeration of IP addresses of VPN services. Put differently, the IPs in this dataset are obtained
by automatically logging in to different VPN regions and grabbing the public IP address. Exit
Nodes are the last node in a VPN tunnel and are the public IP address that websites see when an end user is
connected to a VPN.
This dataset also contains IP addresses of VPN servers. Often, the .ovpn
or
wireguard
configuration files of VPN services contain VPN server information. Server IP addresses are not necessarily
used
by the end users of a VPN service, but it is nevertheless helpful to know that an IP address is a VPN
server.
If the IP address is an VPN exit node, the exitNodeType
field is set to
"exit_node"
. If the IP address is a VPN server, the exitNodeType
field is set to
"vpn_server"
.
The enumerated-vpn.csv
dataset is free from false positives and is the most accurate dataset.
The retention period of this dataset is up to a maximum of 45 days, but mostly much shorter. This means
that an exit node is removed from this dataset after 45 days of staleness.
#interpolated-vpn.csv
- VPN IPs detected by Interpolation
The basic idea behind this dataset is as follows:
If more than 10% (or any other reasonable threshold) of all IP addresses of a network are known to belong to
a
certain VPN service, then all IP addresses of this network are likely to belong to this VPN service.
Only networks up to a certain size are considered (less than 16,384 IP addresses, /18 subnet) and
only if the network is not shared by other VPN services. For example, many VPN services use the British
cloud provider M247 Ltd. to host their VPN servers. So if a M247
network is used by more than one VPN
provider, no interpolation will take place.
This dataset is not completely free from false positives, but the number of false positives is very small.
This dataset is using the enumerated-vpn.csv
dataset as ground truth.
#assumed-vpn.csv
- Assumed VPN IPs
This dataset contains networks that are assumed to belong to VPN services based on the IP address ranges of
the VPN services.
This dataset is not free of false positives and should be used with some caution.
The file format of the enumerated-vpn.csv
Database is either in CSV or MMDB format and contains
the fields below. The other databases don't contain necessarily all fields listed below, such as
exitNodeType
, lastSeen
or exitNodeRegion
field.
ipVersion
- Either 4
(IPv4) or 6
(IPv6), determining
the IP type of the network.
startIp
- The start IP address of the range in string format. Example:
45.86.210.31
endIp
- The end IP address of the range in string format. Example:
45.86.210.31
serviceName
- The name of the VPN provider. Example:
NordVPN
serviceUrl
- The url of the VPN provider. Example:
https://nordvpn.com/
exitNodeType
-The type of the VPN exit node. This is either "exit_node"
or
"vpn_server"
.
The value "exit_node"
is most common and means that the IP address is a VPN exit node that
was detected by
our VPN enumeration system.
The value "vpn_server"
is less common and means that the IP address is a VPN server known to
belong to the
VPN service.
lastSeen
- The unix timestamp in milliseconds of the last time the VPN exit node was
enumerated. Example:
1727258491468
exitNodeRegion
- The region of the VPN exit node. It is in free format. Example:
Singapore - CBD
The
following example contains an small excerpt of the
entire database:
startIp,endIp,ipVersion,serviceName,serviceUrl,exitNodeType,lastSeen,exitNodeRegion
138.199.36.226,138.199.36.226,4,CyberGhost,https://cyberghostvpn.com,exit_node,1727258491468,
31.40.213.170,31.40.213.170,4,NordVPN,https://nordvpn.com,exit_node,1728460051121,
146.70.117.47,146.70.117.47,4,MullvadVPN,https://mullvad.net,exit_node,1728056830418,de-fra-wg-106
31.13.191.94,31.13.191.94,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693675,
185.111.109.2,185.111.109.2,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693661,
193.32.248.73,193.32.248.73,4,MullvadVPN,https://mullvad.net,vpn_server,1729181479218,
45.129.35.50,45.129.35.50,4,NordVPN,https://nordvpn.com,exit_node,1726681383083,
193.29.107.170,193.29.107.170,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693674,
138.199.30.170,138.199.30.170,4,Private Internet Access,https://privateinternetaccess.com,vpn_server,1729181479220,
194.5.82.61,194.5.82.61,4,ExpressVPN,https://expressvpn.com,exit_node,1728492497789,Singapore - CBD
103.163.220.70,103.163.220.70,4,ExpressVPN,https://expressvpn.com,exit_node,1728423195492,Japan - Tokyo
91.214.64.72,91.214.64.72,4,NordVPN,https://nordvpn.com,exit_node,1729181525475,
95.181.237.24,95.181.237.24,4,Private Internet Access,https://privateinternetaccess.com,vpn_server,1729181479220,
146.70.58.131,146.70.58.131,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693670,
103.192.80.131,103.192.80.131,4,Surfshark,https://surfshark.com,vpn_server,1729181362596,
195.158.249.173,195.158.249.173,4,NordVPN,https://nordvpn.com,exit_node,1728892109308,Ljubljana
45.155.64.2,45.155.64.2,4,ExpressVPN,https://expressvpn.com,exit_node,1728871725711,France - Marseille
2a02:6ea0:ce08:3::a07f,2a02:6ea0:ce08:3::a07f,6,MullvadVPN,https://mullvad.net,vpn_server,1729181479218,
154.16.81.167,154.16.81.167,4,Private Internet Access,https://privateinternetaccess.com,vpn_server,1729183687991,
5.180.62.135,5.180.62.135,4,NordVPN,https://nordvpn.com,exit_node,1729197693653,
#
How to use the IP to VPN Database?
This example shows how to work with the IP to VPN Database in MMDB format. First, you have to download the
database sample:
curl -O https://ipapi.is/data/samples/Enumerated-VPN-Database-Sample.mmdb
And then you can read the database with mmdbctl:
mmdbctl read -f json-pretty 2.56.190.14 Enumerated-VPN-Database-Sample.mmdb
which outputs:
{
"exitNodeRegion": "",
"exitNodeType": "exit_node",
"hostname": "",
"ipVersion": "4",
"lastSeen": "1734668735328",
"network": "2.56.190.14-2.56.190.14",
"serviceName": "NordVPN",
"serviceUrl": "https://nordvpn.com"
}
#
Why is VPN Detection Important?
VPN detection is the process of finding out whether an arbitrary IP address belongs to a VPN service and
to which VPN provider it belongs (Such as IPVanish or HideMyAss). It is important to understand that the true
IP
address of the VPN user cannot be revealed.
The IP to VPN Database includes
information about VPN IP addresses. With static methods such as databases, it is not possible to reveal the
real IP address of a client that is using a VPN service.
There are many good reasons why websites or apps want to detect users with a VPN
enabled:
- VPN users bypass geo-restricted content by connecting to a VPN in a different country.
- VPN users committing cybercrime cannot be easily identified - the VPN is protecting the bad guys as
well!
- A VPN service allows a single entity to obtain access to hundreds of different IP addresses from
different countries and thus to bypass rate limits. Therefore, VPN usage is also associated with bot
attacks and
automated threats.
- VPN usage can mask real user locations, enabling fraudulent activities such as credit card fraud or
unauthorized account access. Detecting VPN usage helps businesses implement additional security measures
to reduce the risk of fraud.
- VPNs can give users an unfair advantage in online services, such as in the survey, gaming or ticket
purchasing industry.
Examples
Online Survey Industry: VPN usage distorts YouGov's
survey
results by allowing users outside the
targeted regions to participate, leading to inaccurate data about local opinions and demographics.
Fraudsters are incentivized to participate in online surveys because each completed survey is paid. A survey
completed by a citizen of Switzerland is more expensive than a survey completed by a citizen of an
economically poorer region of the world. By using a VPN, a fraudster can pretend to be a Swiss citizen and
earn more money per survey.
Public Broadcasting and Media: The BBC iPlayer
is only
intended to be used
for
users
in the UK. Therefore, BBC disallows any user that is not located in the UK.
By using a VPN server located in the UK, it is possible to bypass this geo-restriction and use the BBC iPlayer from anywhere in
the world.
Since BBC likely knows
that their geo-restriction is bypassed by some cunning VPN users, they have a justified reason to
disallow
VPN users from accessing their streaming service. This
explains why there is a legitimate interest in knowing whether an Internet user is hiding behind a VPN
server or not.
#
How does VPN Detection Work?
There are several methods to detect VPN usage. At ipapi.is, the following two VPN detection methods are
currently used:
- VPN Exit Node Enumeration: This method consists of purchasing VPN subscriptions from
commercial VPN providers and
then
connecting to
different regions while grabbing the Exit Node IP address.
- Statistical Inference and Data Analysis: By correlation and statistical inference
methods, it is possible to derive new VPN IP ranges. This method only
works if the ground truth data is false positive free (Which is the case with VPN Exit Node Enumeration)
The idea behind VPN Exit Node Enumeration is very simple: A paid
plan from each
VPN provider is purchased. Then, the VPN client application of each provider
is installed, a connection to each region of each provider is made and the VPN exit node IP address is
gathered. Most VPN
providers
allow their users to connect to all
their available regions, but some of the providers might throttle the amount of reconnections per time
span.
Put differently, this detection method works by enumerating all available regions, connecting to each
region and storing the VPN IP address by using tools such as ipapi.is to
get the public IP address.
The hardest part of VPN exit node enumeration is to automate the process of rotating the VPN region
automatically. Most commercial providers such as NordVPN or ExpressVPN do not make it easy to rotate the region
automatically. Nevertheless, automation is certainly possibly for every provider, it just takes a bit
longer.
The biggest advantage of this VPN detection method is the certainty that each obtained IP address
actually belongs to the VPN provider. False positives are virtually impossible.
Furthermore, this detection method is the only one that allows to reliably distinguish to which VPN
provider the IP address actually belongs, since it is known at all times which service is used.
Read more about VPN Detection