"Block datacenter ASNs" is the first VPN rule most developers write, and the list they reach for is public. brianhama/bad-asn-list, with 547 stars on GitHub, names 723 networks belonging to cloud, hosting and colocation companies, Amazon, Google, Microsoft, DigitalOcean, OVH, Hetzner, Linode and M247 among them. When Discord explained its age checks in September, a Hacker News reader asked the question the rule is meant to answer: "why not apply the age verification check to known VPN services and leave residential IPs alone?"
We checked what that list catches. On 2026-10-09, we matched every IPv4 address in our VPN data, 22,497,180 of them, to the network announcing it in the global routing table that day, and counted the ones in a network on the list.
What the list catches
| IPv4 addresses | Total | In a listed network | Caught |
|---|---|---|---|
| Consumer VPN services | 3,199,467 | 2,043,856 | 63.9% |
| Corporate VPN gateways | 1,827,333 | 52,933 | 2.9% |
| Peer-to-peer VPNs | 148,747 | 31,187 | 21.0% |
| Privacy relays | 16,336 | 0 | 0.0% |
| VPN endpoints with no brand attached | 17,305,297 | 551,541 | 3.2% |
| All VPN | 22,497,180 | 2,679,517 | 11.9% |
| Tor | 12,618 | 3,897 | 30.9% |
| Every routed IPv4 address | 3,127,821,712 | 320,970,784 | 10.3% |
The list isn't careless: the big clouds are all on it. But 36.1% of consumer VPN addresses sit in networks it doesn't name, and it barely touches the VPN endpoints with no brand attached, more than three quarters of all VPN addresses.
What it costs
The list blocks 321.0 million addresses, a tenth of the routed IPv4 internet, to catch 2.7 million VPN addresses, about 120 blocked for each one caught. It lets your customers' corporate VPN gateways through, 97.1% of them, which you usually want, and it catches 30.9% of Tor, where the Tor Project's own exit list names every exit.
A network list is still a fair filter for bots: scrapers and credential stuffing run from cloud servers, and that's what the list is for. It's a poor VPN filter.
Check the address instead
Whether an address is a VPN and whether it's in a hosting network are two separate questions, and our API answers both with is_vpn and is_hosting. With the Python package:
# check.py
import os
import sys
from vpndetection import VPNDetection
client = VPNDetection(api_key=os.environ.get("VPNDETECTION_API_KEY"))
for ip in sys.argv[1:]:
result = client.lookup(ip)
if result.is_vpn:
verdict = "VPN"
elif result.flagged("is_hosting"):
verdict = "hosting, not a VPN"
else:
verdict = "neither"
print(f"{ip}: {verdict}")$ python check.py 141.98.252.67 1.1.1.1
141.98.252.67: VPN
1.1.1.1: hosting, not a VPN141.98.252.67 is a Mullvad server in London, from Mullvad's own server list. We ran it against the live API on October 9, 2026, with vpndetection 5.7.0. flagged() reads a flag your plan doesn't include as False, and is_hosting starts on the Starter plan (pricing).
How we measured
We took the list's 723 network numbers as published on GitHub on 2026-10-09, and every IPv4 address in our VPN, Tor and routing data from the same day. Consumer services are the commercial VPN brands people choose servers on. Corporate gateways are business VPN products, peer-to-peer VPNs run on their users' own connections, and privacy relays are services like iCloud Private Relay. The endpoints with no brand attached are VPN servers we haven't tied to a provider. Each address counts once, under the network that announced it.
