Which services are in it?

Apple iCloud Private Relay, Google's VPNs, and web gateways such as Cisco's and Zscaler's among them. The Relay Provider catalog below names every provider id.

Where do the ranges come from?

From the lists the operators publish of their own egress, never inferred. A range stays for 90 days after its operator last listed it, and last_seen says when that was.

Open

Privacy relays and enterprise web gateways.

Apple Private Relay, Google's VPN and company web gateways such as Zscaler's: ordinary people with a privacy setting on or at work, not abuse infrastructure.

Schema

See documentation →

Published as CSVGZ and MMDB. Every column is described in the docs.

start_ip	end_ip	provider	confidence	last_seen
2a02:26f7:b550:4000::	2a02:26f7:b550:4000:ffff:ffff:ffff:ffff	apple_private_relay	high	2026-09-06
2a02:26f7:e7c2:4000::	2a02:26f7:e7c2:4000:ffff:ffff:ffff:ffff	apple_private_relay	high	2026-09-06
2606:40:21dc:4000::	2606:40:21dc:43ff:ffff:ffff:ffff:ffff	google_vpn	high	2026-09-06
2606:40:219a:2000::	2606:40:219a:23ff:ffff:ffff:ffff:ffff	google_vpn	high	2026-09-06
2a02:26f7:ef00:59d9::	2a02:26f7:ef00:59da:ffff:ffff:ffff:ffff	apple_private_relay	high	2026-09-06

relay_ip_v1

Entries

176,107

Refresh

Daily

CSVGZ

1.15 MB

MMDB

1.12 MB

Relay Provider

The operators behind the ids.

Relay Provider documentation →

provider is an id that holds from build to build. Relay Provider resolves each one to the service's name and homepage, and whether we track it. Join it on provider.

id	name	url	active	note
apple_private_relay	Apple iCloud Private Relay	https://www.apple.com/icloud/	t
google_vpn	Google One VPN	https://one.google.com/about/vpn/	t
cisco_secure_web_gateway	Cisco Secure Web Gateway	https://www.cisco.com/site/us/en/products/security/secure-web-gateway/	t	Enterprise managed egress (Umbrella).

relay_provider_v1

Entries

Downloading it from code.

Database API reference →

One call gets you the current Relay IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.

download()

Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.

downloadUrl()

The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.

downloadBytes()

The build in memory, for a small dataset or a pipeline that never touches a filesystem.

metadata()

Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.

checksums()

The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.

import os
from vpndetection import VPNDetection
 
client = VPNDetection(os.environ["VPNDETECTION_API_KEY"])
 
# to disk, streamed
client.database.download("relay_ip_v1", "csvgz", "relay_ip_v1.csv.gz")
# a time-limited link
url = client.database.download_url("relay_ip_v1", "csvgz")
# in memory
raw = client.database.download_bytes("relay_ip_v1", "csvgz")

download.pypip install vpndetection

Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

What it's used for

Three decisions Relay IP is bought for, and what each needs from the data rather than from a score.

Do not punish a checkbox

Relay users are usually your best customers with a privacy setting on, or at work behind their company's gateway. Separating them from VPN traffic prevents an expensive class of false positive.

Keep geo decisions honest

Relay egress rarely matches the customer's real region, so treat location from these addresses as unknown rather than wrong.

Named per provider

Provider tells you whether it is Apple, Google, Zscaler or another, so you can allow one without allowing all.

Free with an account

Sign up, then download it from the console, or with your API key from the API or any official client, under CC BY-SA 4.0.

Checksums published per file: md5, sha1, sha256 and sha512.

The id pins the schema version, so a new build never changes the columns your parser reads.

Official SDKs

All SDKs on GitHub →

Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.

Node.js Python Go Java .NET PHP Ruby Rust Swift Erlang Perl Zig Express Fastify Next.js Django Flask FastAPI Laravel Symfony Rails Spring Boot ASP.NET Core net/http Gin Axum Cowboy

Common questions

Read the docs →API reference →Email support →

On this page

How is a relay different from a VPN?

A relay is built into an operating system, a browser or a company's web gateway, so its users are mostly ordinary people with a privacy feature switched on, or at work behind their company's gateway. It's kept apart from VPN IP so a VPN rule doesn't catch them.

00 · No key

Start without signing up.

Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.

curl "https://api.vpndetection.io/146.70.116.130"

{
  "ip": "146.70.116.130",
  "is_vpn": true
}

01 · Free key

Sign up and get 50,000 requests a month.

No card and no sales call: the key is issued on signup.

Every request flags VPN IPs.

Upgrade only when you outgrow the allowance.

Get a free API key See pricing