IP to VPN Database

The IP to VPN Database is a database that contains VPN IP addresses from well-known providers like ExpressVPN and NordVPN. Additionally, the database contains IP ranges from other VPN providers from which the provider's name is not known. The database is updated on a regular basis and is available for purchase in CSV or MMDB format.

Despite the fact that VPN services bring a lot of benefits to its users, they also have a dark side. VPN services are often used by cybercriminals to hide their real IP address and to bypass geo-restrictions and commit fraud. The IP to VPN Database is a valuable tool for businesses that want to detect VPN usage on their website or app and to take appropriate measures to protect their services.

{
  "message": "Please make an API request",
}

# Purchase Database

To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file for all formats.

# VPN Database Datasets

The IP to VPN Database contains three different datasets with different detection accuracy and different false positive rates. All datasets have false negatives, meaning that they are not 100% complete in detecting all VPN IPs that exist in the world. It needs to be noted that no commercial VPN detection service is 100% accurate in detecting all VPN IPs.

• enumerated-vpn.csv - VPN IPs detected by Exit Node Enumeration
• interpolated-vpn.csv - VPN IPs detected by Interpolation, using the enumerated-vpn.csv dataset as a source of truth
• assumed-vpn.csv - Assumed VPN IPs, lots of false positives

#enumerated-vpn.csv - VPN IPs detected by Exit Node Enumeration

This is the most accurate dataset and is based on the detection of VPN Exit Nodes by systematic and automatic enumeration of IP addresses of VPN services. Put differently, the IPs in this dataset are obtained by logging in to different VPN regions and grabbing the public IP address repeatedly. Exit Nodes are the last node in a VPN tunnel and are the public IP address that websites see when an end user is connected to a VPN.

This dataset also contains IP addresses of VPN servers. Often, the .ovpn or wireguard configuration files of VPN services contain VPN server information. Server IP addresses are not necessarily used by the end users of a VPN service, but it is nevertheless helpful to know that an IP address is a VPN server. If the IP address is an VPN exit node, the exitNodeType field is set to "exit_node". If the IP address is a VPN server, the exitNodeType field is set to "vpn_server".

If the IP address is an VPN exit node, the exitNodeType field is set to "exit_node". If the IP address is a VPN server, the exitNodeType field is set to "vpn_server".

This dataset is free from false positives and is the most accurate dataset.

The retention period of this dataset is up to a maximum of 45 days, but mostly much shorter. This means that an exit node is removed from this dataset after 45 days of staleness.

#interpolated-vpn.csv - VPN IPs detected by Interpolation

The basic idea behind this dataset is as follows:

If more than 10% (or any other reasonable threshold) of all IP addresses of a certain network are known to belong to a certain VPN service, then all IP addresses of this network are likely to belong to this VPN service.

Only networks up to a certain size are considered (less than 16,384 IP addresses, /18 subnet) and only if the network is not shared by other VPN services. For example, many VPN services use the British cloud provider M247 Ltd. to host their VPN servers. So if a certain M247 network is used by more than one VPN provider, no interpolation will take place.

This dataset is not completely free from false positives, but the number of false positives is very small.

This dataset is using the enumerated-vpn.csv dataset as a source of truth.

#assumed-vpn.csv - Assumed VPN IPs

This dataset contains networks that are assumed to belong to VPN services based on the IP address ranges of the VPN services.

This dataset is not free of false positives and should be used with some caution.

# VPN Database Format

The file format of the enumerated-vpn.csv Database is either in CSV or MMDB format and contains the fields below. The other databases don't contain necessarily all fields listed below, such as exitNodeType, lastSeen or exitNodeRegion field.

• ipVersion - Either 4 (IPv4) or 6 (IPv6), determining the IP type of the network.
• startIp - The start IP address of the range in string format. Example: 45.86.210.31
• endIp - The end IP address of the range in string format. Example: 45.86.210.31
• serviceName - The name of the VPN provider. Example: NordVPN
• serviceUrl - The url of the VPN provider. Example: https://nordvpn.com/
• exitNodeType -The type of the VPN exit node. This is either "exit_node" or "vpn_server". The value "exit_node" is most common and means that the IP address is a VPN exit node that was detected by our VPN enumeration system. The value "vpn_server" is less common and means that the IP address is a VPN server known to belong to the VPN service.
• lastSeen - The unix timestamp in milliseconds of the last time the VPN exit node was enumerated. Example: 1727258491468
• exitNodeRegion - The region of the VPN exit node. It is in free format. Example: Singapore - CBD

The following example contains an small excerpt of the entire database:

startIp,endIp,ipVersion,serviceName,serviceUrl,exitNodeType,lastSeen,exitNodeRegion
138.199.36.226,138.199.36.226,4,CyberGhost,https://cyberghostvpn.com,exit_node,1727258491468,
31.40.213.170,31.40.213.170,4,NordVPN,https://nordvpn.com,exit_node,1728460051121,
146.70.117.47,146.70.117.47,4,MullvadVPN,https://mullvad.net,exit_node,1728056830418,de-fra-wg-106
31.13.191.94,31.13.191.94,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693675,
185.111.109.2,185.111.109.2,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693661,
193.32.248.73,193.32.248.73,4,MullvadVPN,https://mullvad.net,vpn_server,1729181479218,
45.129.35.50,45.129.35.50,4,NordVPN,https://nordvpn.com,exit_node,1726681383083,
193.29.107.170,193.29.107.170,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693674,
138.199.30.170,138.199.30.170,4,Private Internet Access,https://privateinternetaccess.com,vpn_server,1729181479220,
194.5.82.61,194.5.82.61,4,ExpressVPN,https://expressvpn.com,exit_node,1728492497789,Singapore - CBD
103.163.220.70,103.163.220.70,4,ExpressVPN,https://expressvpn.com,exit_node,1728423195492,Japan - Tokyo
91.214.64.72,91.214.64.72,4,NordVPN,https://nordvpn.com,exit_node,1729181525475,
95.181.237.24,95.181.237.24,4,Private Internet Access,https://privateinternetaccess.com,vpn_server,1729181479220,
146.70.58.131,146.70.58.131,4,ProtonVPN,https://protonvpn.com,exit_node,1729197693670,
103.192.80.131,103.192.80.131,4,Surfshark,https://surfshark.com,vpn_server,1729181362596,
195.158.249.173,195.158.249.173,4,NordVPN,https://nordvpn.com,exit_node,1728892109308,Ljubljana
45.155.64.2,45.155.64.2,4,ExpressVPN,https://expressvpn.com,exit_node,1728871725711,France - Marseille
2a02:6ea0:ce08:3::a07f,2a02:6ea0:ce08:3::a07f,6,MullvadVPN,https://mullvad.net,vpn_server,1729181479218,
154.16.81.167,154.16.81.167,4,Private Internet Access,https://privateinternetaccess.com,vpn_server,1729183687991,
5.180.62.135,5.180.62.135,4,NordVPN,https://nordvpn.com,exit_node,1729197693653,

# How to use the IP to VPN Database?

This example shows how to work with the IP to VPN Database in MMDB format. First, you have to download the database sample:

curl -O https://ipapi.is/data/samples/VPN-Database-Sample.mmdb

And then you can read the database with mmdbctl:

mmdbctl read -f json-pretty 2.56.190.136 VPN-Database-Sample.mmdb

which outputs:

{
  "exitNodeRegion": "",
  "exitNodeType": "exit_node",
  "ipVersion": "4",
  "lastSeen": "1729525180578",
  "network": "2.56.190.136-2.56.190.136",
  "serviceName": "NordVPN",
  "serviceUrl": "https://nordvpn.com"
}

# Why is VPN Detection Important?

VPN detection is the process of finding out whether an arbitrary IP address belongs to a VPN service and to which VPN provider it belongs (Such as IPVanish or HideMyAss). It is important to understand that the true IP address of the VPN user cannot be revealed.

There are many good reasons why websites or apps want to detect users with a VPN enabled:

• VPN users bypass geo-restricted content by connecting to a VPN in a different country.
• VPN users committing cybercrime cannot be easily identified - the VPN is protecting the bad guys as well!
• A VPN service allows a single entity to obtain access to hundreds of different IP addresses from different countries and thus to bypass rate limits. Therefore, VPN usage is also associated with bot attacks and automated threats.
• VPN usage can mask real user locations, enabling fraudulent activities such as credit card fraud or unauthorized account access. Detecting VPN usage helps businesses implement additional security measures to reduce the risk of fraud.
• VPNs can give users an unfair advantage in online services, such as in the survey, gaming or ticket purchasing industry.

Examples

Online Survey Industry: VPN usage distorts YouGov's survey results by allowing users outside the targeted regions to participate, leading to inaccurate data about local opinions and demographics. Fraudsters are incentivized to participate in online surveys because each completed survey is paid. A survey completed by a citizen of Switzerland is more expensive than a survey completed by a citizen of an economically poorer region of the world. By using a VPN, a fraudster can pretend to be a Swiss citizen and earn more money per survey.

Public Broadcasting and Media: The BBC iPlayer is only intended to be used for users in the UK. Therefore, BBC disallows any user that is not located in the UK. By using a VPN server located in the UK, it is possible to bypass this geo-restriction and use the BBC iPlayer from anywhere in the world.

Since BBC likely knows that their geo-restriction is bypassed by some cunning VPN users, they have a justified reason to disallow VPN users from accessing their streaming service. This explains why there is a legitimate interest in knowing whether an Internet user is hiding behind a VPN server or not.

# How does VPN Detection Work?

There are several methods to detect VPN usage. At ipapi.is, the following two VPN detection methods are currently used:

• VPN Exit Node Enumeration: This method consists of purchasing VPN subscriptions from commercial VPN providers and then connecting to different regions while grabbing the Exit Node IP address.
• Statistical Inference and Data Analysis: By correlation and statistical inference methods, it is possible to derive new VPN IP ranges. This method only works if the ground truth data is false positive free (Which is the case with VPN Exit Node Enumeration)

The idea behind VPN Exit Node Enumeration is very simple: A paid plan from each VPN provider is purchased. Then, the VPN client application of each provider is installed, a connection to each region of each provider is made and the VPN exit node IP address is gathered. Most VPN providers allow their users to connect to all their available regions, but some of the providers might throttle the amount of reconnections per time span.

Put differently, this detection method works by enumerating all available regions, connecting to each region and storing the VPN IP address by using tools such as ipapi.is to get the public IP address.

The hardest part of VPN exit node enumeration is to automate the process of rotating the VPN region automatically. Most commercial providers such as NordVPN or ExpressVPN do not make it easy to rotate the region automatically. Nevertheless, automation is certainly possibly for every provider, it just takes a bit longer.

The biggest advantage of this VPN detection method is the certainty that each obtained IP address actually belongs to the VPN provider. False positives are virtually impossible.

Furthermore, this detection method is the only one that allows to reliably distinguish to which VPN provider the IP address actually belongs, since it is known at all times which service is used.