Skip to content
VPNDetection

Edge networks, so delivery is not mistaken for fraud.

Content delivery and edge ranges. Traffic arriving through an edge is infrastructure doing its job, and shouldn't score like an anonymizer.

Request access

Published as CSVGZ and MMDB. Every column is described in the docs.

start_ipend_ipproviderconfidencelast_seen
2a03:90c0:4c1:2801::42a03:90c0:4c1:2801::8gcorehigh2026-09-17
109.61.39.85109.61.39.85gcorehigh2026-09-17
92.223.63.892.223.63.11gcorehigh2026-09-17
2a01:c9c0:c004:100::32a01:c9c0:c004:100::3gcorehigh2026-09-17
92.223.118.21492.223.118.222gcorehigh2026-09-17
ID
cdn_ip_v1
Entries
126,496
Refresh
Daily
CSVGZ
796 KB
MMDB
1000 KB
CDN Provider

The operators behind the ids.

CDN Provider documentation →

provider is an id that holds from build to build. CDN Provider resolves each one to the network's name and homepage, and whether we track it. Join it on provider.

idnameurlactivenote
cloudflareCloudflarehttps://www.cloudflare.com/t
akamaiAkamaihttps://www.akamai.com/t
azureMicrosoft Azure CDNhttps://azure.microsoft.com/products/cdntAzure Front Door / Azure CDN edge.
ID
cdn_provider_v1
Entries
61

Downloading it from code.

Database API reference →

One call gets you the current CDN IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.

download()
Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.
downloadUrl()
The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.
downloadBytes()
The build in memory, for a small dataset or a pipeline that never touches a filesystem.
metadata()
Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.
checksums()
The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.
import os
from vpndetection import VPNDetection
client = VPNDetection(os.environ["VPNDETECTION_API_KEY"])
# to disk, streamed
client.database.download("cdn_ip_v1", "csvgz", "cdn_ip_v1.csv.gz")
# a time-limited link
url = client.database.download_url("cdn_ip_v1", "csvgz")
# in memory
raw = client.database.download_bytes("cdn_ip_v1", "csvgz")
download.pypip install vpndetection
Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

What it's used for

Three decisions CDN IP is bought for, and what each needs from the data rather than from a score.

Stop scoring your own edge

If your traffic is fronted by a CDN, those addresses will appear constantly. Flagging them keeps them out of your risk signals.

Tell delivery from disguise

An edge network and a proxy network look similar from a single address. The distinction is the point of this dataset.

Attributed to the network

Provider names the edge operator so you can allow specific ones.

License the full database
Sales will quote on volume, term and whether you need redistribution rights.
Checksums published per file: md5, sha1, sha256 and sha512.
The id pins the schema version, so a new build never changes the columns your parser reads.
Samples are cut from the current build, not a synthetic extract.

Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.

On this page

Why allowlist CDN traffic?

A request that leaves through a CDN edge carries the edge's address, not its client's. Treated as ordinary traffic, one edge looks like a single, very busy user.

00 · No key

Start without signing up.

Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.

curl "https://api.vpndetection.io/146.70.116.130"
{
"ip": "146.70.116.130",
"is_vpn": true
}
01 · Free key

Sign up and get 50,000 requests a month.

No card and no sales call: the key is issued on signup.
Every request flags VPN IPs.
Upgrade only when you outgrow the allowance.