Skip to content
VPNDetection

Cloud and hosting ranges, attributed to the provider.

Server address space across the major clouds and hosting companies, whose traffic should never look like a residential customer's.

Request access

Published as CSVGZ and MMDB. Every column is described in the docs.

start_ipend_ipproviderconfidencelast_seen
69.195.69.069.195.70.255unifiedlayerhigh2026-09-06
188.221.236.0188.221.236.255m247high2026-09-06
121.196.177.0121.196.177.255alibabahigh2026-09-06
45.38.3.045.38.3.2553hcloudhigh2026-09-06
2603:c011:8000::2603:c011:8fff:ffff:ffff:ffff:ffff:fffforaclehigh2026-09-06
ID
hosting_ip_v1
Entries
490,423
Refresh
Daily
CSVGZ
3.33 MB
MMDB
6.25 MB
Hosting Provider

The operators behind the ids.

Hosting Provider documentation →

provider is an id that holds from build to build. Hosting Provider resolves each one to the operator's name and homepage, whether we track it, and the kinds of hosting it sells. Join it on provider.

idnameurlactivekindnote
awsAmazon Web Serviceshttps://aws.amazon.com/tcloud
hetznerHetzner Onlinehttps://www.hetzner.com/tdedicated|vps|cloud
m247M247https://www.m247.com/tcolo|dedicated
ID
hosting_provider_v1
Entries
785

Downloading it from code.

Database API reference →

One call gets you the current Hosting IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.

download()
Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.
downloadUrl()
The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.
downloadBytes()
The build in memory, for a small dataset or a pipeline that never touches a filesystem.
metadata()
Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.
checksums()
The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.
import os
from vpndetection import VPNDetection
client = VPNDetection(os.environ["VPNDETECTION_API_KEY"])
# to disk, streamed
client.database.download("hosting_ip_v1", "csvgz", "hosting_ip_v1.csv.gz")
# a time-limited link
url = client.database.download_url("hosting_ip_v1", "csvgz")
# in memory
raw = client.database.download_bytes("hosting_ip_v1", "csvgz")
download.pypip install vpndetection
Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

What it's used for

Three decisions Hosting IP is bought for, and what each needs from the data rather than from a score.

Separate bots from browsers

A signup from a datacenter range is a different risk from the same signup on a home connection, before you look at anything else.

Whitelist your own infrastructure

Provider attribution lets you allow your own cloud without allowing every cloud.

Catch scrapers early

Most scraping arrives from hosting before it graduates to residential proxies.

License the full database
Sales will quote on volume, term and whether you need redistribution rights.
Checksums published per file: md5, sha1, sha256 and sha512.
The id pins the schema version, so a new build never changes the columns your parser reads.
Samples are cut from the current build, not a synthetic extract.

Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.

On this page

What does a row tell us?

One range that belongs to a hosting, cloud or datacenter provider, the provider's id, how sure we are of it and the last day it was observed.

00 · No key

Start without signing up.

Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.

curl "https://api.vpndetection.io/146.70.116.130"
{
"ip": "146.70.116.130",
"is_vpn": true
}
01 · Free key

Sign up and get 50,000 requests a month.

No card and no sales call: the key is issued on signup.
Every request flags VPN IPs.
Upgrade only when you outgrow the allowance.