Every commercial VPN exit, with the operator named.
The addresses commercial VPN services exit from, each attributed to its service and scored for confidence. Rebuilt every day.
Schema
See documentation →Published as CSVGZ and MMDB. Every column is described in the docs. For how each range was established, see VPN IP Extended.
| start_ip | end_ip | provider | confidence | last_seen |
|---|---|---|---|---|
| 216.131.87.112 | 216.131.87.127 | ipvanish | high | 2026-09-08 |
| 208.85.18.71 | 208.85.18.71 | tunnelbear | high | 2026-09-07 |
| 187.13.129.184 | 187.13.129.187 | nordvpn | high | 2026-09-07 |
| 172.235.240.0 | 172.235.240.11 | metrovpn_net | medium | 2026-09-04 |
| 95.170.13.20 | 95.170.13.23 | pingvpn_pingsecure | low | 2026-06-16 |
The operators behind the ids.
provider is an id that holds from build to build. VPN Provider resolves each one to the operator's name and homepage, whether we track its addresses, the features it advertises and whether it has gone defunct. Join it on provider.
| id | name | url | active | features | note | defunct |
|---|---|---|---|---|---|---|
| nordvpn | NordVPN | https://nordvpn.com/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|dedicated_nodes|exit_node_selection|streaming_unblocking|paid | f | |
| mullvad | Mullvad | https://mullvad.net/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|exit_node_selection|paid | f | |
| tunnelbear | TunnelBear | https://www.tunnelbear.com/ | t | no_logging_policy|torrent_allowed|kill_switch|exit_node_selection|free|paid | f |
Downloading it from code.
Database API reference →One call gets you the current VPN IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()What it's used for
Three decisions VPN IP is bought for, and what each needs from the data rather than from a score.
Stop account sharing and region hopping
Knowing the service, not just that a VPN is present, lets you treat a privacy-conscious customer differently from a bulk abuse network.
Tune rules per operator
Provider ids are stable across builds, so a rule you write against one service keeps working as its ranges rotate.
Explain the decision
Confidence and last seen give a support team something concrete to say when a legitimate customer is challenged.
Official SDKs
All SDKs on GitHub →Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.
Common questions
What does a row tell us?
One range observed as a commercial VPN's exit, the provider that operates it, how sure we are of the observation, and the last day it was made. IPv4 and IPv6 are in the same file.
What does confidence mean?
high, medium or low: how sure we are that the range is the provider's. It's graded by how reliable the evidence behind the range has proven for that provider, so the same kind of evidence can earn high for one provider and low for another.
Are provider ids stable?
Yes. An id stays the same across builds, so a rule written against an operator keeps working as its ranges rotate. The VPN Provider catalog below names each one, with its features and whether it's defunct.
Does it cover white-label VPNs?
Yes, though each address carries one provider. Where brands resell or share one fleet, its addresses are published under one of them.
What does VPN IP Extended add?
A method column recording how each range was established, scan, scrape, registry or infer, for weighing ranges by the kind of evidence behind them.
How often is it rebuilt?
Daily. The metadata call says when the current build landed and how many rows it holds, so you fetch only a new one.
Which formats does it ship in?
Gzipped CSV and MMDB, both cut from the same build. The MMDB opens in any MaxMind DB reader, so lookups run in memory on your own servers.
How do we get it?
Under a database license, agreed per dataset and bundled with Enterprise plans. Request access names VPN IP to us, and once it's licensed it downloads from the console, the database API or any official client, or each new build is announced to your webhook, or written to your AWS S3 or S3-compatible storage, Google Cloud Storage, Azure Blob Storage, or an SFTP or FTPS server. Download sample gets you rows from the current build first.
Is it the same data the API answers from?
Yes. A lookup's is_vpn comes from these builds, so the file and the API agree on an address.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Start without signing up.
Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.
{"ip": "146.70.116.130","is_vpn": true}