Cloud and hosting ranges, attributed to the provider.
Server address space across the major clouds and hosting companies, whose traffic should never look like a residential customer's.
Schema
See documentation →Published as CSVGZ and MMDB. Every column is described in the docs.
| start_ip | end_ip | provider | confidence | last_seen |
|---|---|---|---|---|
| 69.195.69.0 | 69.195.70.255 | unifiedlayer | high | 2026-09-06 |
| 188.221.236.0 | 188.221.236.255 | m247 | high | 2026-09-06 |
| 121.196.177.0 | 121.196.177.255 | alibaba | high | 2026-09-06 |
| 45.38.3.0 | 45.38.3.255 | 3hcloud | high | 2026-09-06 |
| 2603:c011:8000:: | 2603:c011:8fff:ffff:ffff:ffff:ffff:ffff | oracle | high | 2026-09-06 |
The operators behind the ids.
provider is an id that holds from build to build. Hosting Provider resolves each one to the operator's name and homepage, whether we track it, and the kinds of hosting it sells. Join it on provider.
| id | name | url | active | kind | note |
|---|---|---|---|---|---|
| aws | Amazon Web Services | https://aws.amazon.com/ | t | cloud | |
| hetzner | Hetzner Online | https://www.hetzner.com/ | t | dedicated|vps|cloud | |
| m247 | M247 | https://www.m247.com/ | t | colo|dedicated |
Downloading it from code.
Database API reference →One call gets you the current Hosting IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()What it's used for
Three decisions Hosting IP is bought for, and what each needs from the data rather than from a score.
Separate bots from browsers
A signup from a datacenter range is a different risk from the same signup on a home connection, before you look at anything else.
Whitelist your own infrastructure
Provider attribution lets you allow your own cloud without allowing every cloud.
Catch scrapers early
Most scraping arrives from hosting before it graduates to residential proxies.
Official SDKs
All SDKs on GitHub →Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.
Common questions
What does a row tell us?
One range that belongs to a hosting, cloud or datacenter provider, the provider's id, how sure we are of it and the last day it was observed.
What does confidence mean?
high or medium: how sure we are that the range is hosting space, medium being less sure than high.
Can we tell cloud from bulletproof hosting?
Yes. Join provider onto the Hosting Provider catalog below, whose kind column separates cloud, VPS, dedicated, colocation and bulletproof operators.
Does a hosting address mean a bot?
Not by itself. It means the address is infrastructure rather than a residential line, where VPN exits, proxies and crawlers live alongside ordinary servers. Weigh it with what else you know.
How often is it rebuilt?
Daily. The metadata call says when the current build landed and how many rows it holds, so you fetch only a new one.
Which formats does it ship in?
Gzipped CSV and MMDB, both cut from the same build. The MMDB opens in any MaxMind DB reader, so lookups run in memory on your own servers.
How do we get it?
Under a database license, agreed per dataset and bundled with Enterprise plans. Request access names Hosting IP to us, and once it's licensed it downloads from the console, the database API or any official client, or each new build is announced to your webhook, or written to your AWS S3 or S3-compatible storage, Google Cloud Storage, Azure Blob Storage, or an SFTP or FTPS server. Download sample gets you rows from the current build first.
Is it the same data the API answers from?
Yes. A lookup's is_hosting comes from these builds, so the file and the API agree on an address.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Start without signing up.
Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.
{"ip": "146.70.116.130","is_vpn": true}