IP to VPN Database
Page Last Updated:
June 17, 2024
IP to VPN Database
VPN Detection
VPN Exit Node Enumeration
The IP to VPN Database includes VPN IP addresses from well-known providers like
ExpressVPN and
NordVPN. Additionally, the database contains IP ranges from other VPN
providers where the specific provider cannot be identified, but the IP addresses are known to be used for
Virtual Private Networks.
IP to VPN Database
Filesize
2.0M
Num VPN IPs
218,285,976
Num IPs with known VPN Provider
76,940
Last Updated
June 25, 2024
Purchase Database
To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be
canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file.
The file format of the IP to VPN Database is in CSV format and contains the following fields:
ipVersion
- Either 4
(IPv4) or 6
(IPv6), determining
the IP type of the network.
startIp
- The start IP address of the range in string format. Example:
45.86.210.31
endIp
- The end IP address of the range in string format. Example:
45.86.210.31
serviceName
- The name of the VPN provider. Example:
NordVPN
The
following example contains an small excerpt of the
entire database:
4,103.108.231.107,103.108.231.107,MullvadVPN
4,45.86.210.31,45.86.210.31,NordVPN
4,149.88.16.250,149.88.16.250,NordVPN
4,185.214.97.39,185.214.97.39,NordVPN
4,89.187.180.37,89.187.180.37,ProtonVPN
4,185.214.97.133,185.214.97.133,NordVPN
4,91.196.69.121,91.196.69.121,NordVPN
4,191.101.177.213,191.101.177.213,expressvpn
4,205.185.209.238,205.185.209.238,IPVanish
4,31.187.94.97,31.187.94.97,vpnfacile
4,37.120.157.107,37.120.157.107,vpnac
4,193.160.246.223,193.160.246.223,NordVPN
4,205.185.193.148,205.185.193.148,ipvanish
4,185.214.97.200,185.214.97.200,NordVPN
4,5.133.9.203,5.133.9.203,Surfshark
4,193.187.130.247,193.187.130.247,NordVPN
4,185.202.221.36,185.202.221.36,NordVPN
4,45.84.39.102,45.84.39.102,NordVPN
4,37.46.122.192,37.46.122.192,NordVPN
4,173.245.207.9,173.245.207.9,IPVanish
4,188.240.57.110,188.240.57.110,Surfshark
4,169.53.175.36,169.53.175.36,vpnht
4,37.19.221.169,37.19.221.169,Mullvad
4,173.244.55.130,173.244.55.130,ExpressVPN
4,209.234.253.4,209.234.253.4,IPVanish
4,194.35.122.208,194.35.122.208,NordVPN
4,45.10.155.253,45.10.155.253,NordVPN
4,87.249.138.224,87.249.138.224,NordVPN
4,128.90.145.3,128.90.145.3,VyprVPN
4,84.21.168.235,84.21.168.235,NordVPN
4,193.9.35.4,193.9.35.4,NordVPN
#
Why is VPN Detection Important?
VPN detection is the process of finding out whether an arbitrary IP address belongs to a VPN service and
to which VPN provider it belongs (Such as IPVanish or HideMyAss). It is important to understand that the true
IP
address of the VPN user cannot be revealed.
The IP to VPN Database includes
information about VPN IP addresses. With static methods such as databases, it is not possible to reveal the
real IP address of a client that is using a VPN service.
There are many good reasons why websites or apps want to detect users with a VPN
enabled:
- VPN users bypass geo-restricted content by connecting to a VPN in a different country.
- VPN users committing cybercrime cannot be easily identified - the VPN is protecting the bad guys as
well!
- A VPN service allows a single entity to obtain access to hundreds of different IP addresses from
different countries and thus to bypass rate limits. Therefore, VPN usage is also associated with bot
attacks and
automated threats.
- VPN usage can mask real user locations, enabling fraudulent activities such as credit card fraud or
unauthorized account access. Detecting VPN usage helps businesses implement additional security measures
to reduce the risk of fraud.
- VPNs can give users an unfair advantage in online services, such as in the survey, gaming or ticket
purchasing industry.
Examples
Online Survey Industry: VPN usage distorts YouGov's
survey
results by allowing users outside the
targeted regions to participate, leading to inaccurate data about local opinions and demographics.
Fraudsters are incentivized to participate in online surveys because each completed survey is paid. A survey
completed by a citizen of Switzerland is more expensive than a survey completed by a citizen of an
economically poorer region of the world. By using a VPN, a fraudster can pretend to be a Swiss citizen and
earn more money per survey.
Public Broadcasting and Media: The BBC iPlayer
is only
intended to be used
for
users
in the UK. Therefore, BBC disallows any user that is not located in the UK.
By using a VPN server located in the UK, it is possible to bypass this geo-restriction and use the BBC iPlayer from anywhere in
the world.
Since BBC likely knows
that their geo-restriction is bypassed by some cunning VPN users, they have a justified reason to
disallow
VPN users from accessing their streaming service. This
explains why there is a legitimate interest in knowing whether an Internet user is hiding behind a VPN
server or not.
#
How does VPN Detection Work?
There are several methods to detect VPN usage. At ipapi.is, the following two VPN detection methods are
currently used:
- VPN Exit Node Enumeration: This method consists of purchasing VPN subscriptions from
commercial VPN providers and
then
connecting to
different regions while grabbing the Exit Node IP address.
- Statistical Inference and Data Analysis: By correlation and statistical inference
methods, it is possible to derive new VPN IP ranges. This method only
works if the ground truth data is false positive free (Which is the case with VPN Exit Node Enumeration)
The idea behind VPN Exit Node Enumeration is very simple: A paid
plan from each
VPN provider is purchased. Then, the VPN client application of each provider
is installed, a connection to each region of each provider is made and the VPN exit node IP address is
gathered. Most VPN
providers
allow their users to connect to all
their available regions, but some of the providers might throttle the amount of reconnections per time
span.
Put differently, this detection method works by enumerating all available regions, connecting to each
region and storing the VPN IP address by using tools such as ipapi.is to
get the public IP address.
The hardest part of VPN exit node enumeration is to automate the process of rotating the VPN region
automatically. Most commercial providers such as NordVPN or ExpressVPN do not make it easy to rotate the region
automatically. Nevertheless, automation is certainly possibly for every provider, it just takes a bit
longer.
The biggest advantage of this VPN detection method is the certainty that each obtained IP address
actually belongs to the VPN provider. False positives are virtually impossible.
Furthermore, this detection method is the only one that allows to reliably distinguish to which VPN
provider the IP address actually belongs, since it is known at all times which service is used.
Read more about VPN Detection