Skip to content
VPNDetection

Every commercial VPN exit, with the operator named.

The addresses commercial VPN services exit from, each attributed to its service and scored for confidence. Rebuilt every day.

Request access

Published as CSVGZ and MMDB. Every column is described in the docs. For how each range was established, see VPN IP Extended.

start_ipend_ipproviderconfidencelast_seen
216.131.87.112216.131.87.127ipvanishhigh2026-09-08
208.85.18.71208.85.18.71tunnelbearhigh2026-09-07
187.13.129.184187.13.129.187nordvpnhigh2026-09-07
172.235.240.0172.235.240.11metrovpn_netmedium2026-09-04
95.170.13.2095.170.13.23pingvpn_pingsecurelow2026-06-16
ID
vpn_ip_v1
Entries
12,616,000
Refresh
Daily
CSVGZ
86.79 MB
MMDB
75.62 MB
VPN Provider

The operators behind the ids.

VPN Provider documentation →

provider is an id that holds from build to build. VPN Provider resolves each one to the operator's name and homepage, whether we track its addresses, the features it advertises and whether it has gone defunct. Join it on provider.

idnameurlactivefeaturesnotedefunct
nordvpnNordVPNhttps://nordvpn.com/tno_logging_policy|torrent_allowed|kill_switch|multihop|dedicated_nodes|exit_node_selection|streaming_unblocking|paidf
mullvadMullvadhttps://mullvad.net/tno_logging_policy|torrent_allowed|kill_switch|multihop|exit_node_selection|paidf
tunnelbearTunnelBearhttps://www.tunnelbear.com/tno_logging_policy|torrent_allowed|kill_switch|exit_node_selection|free|paidf
ID
vpn_provider_v3
Entries
3,609

Downloading it from code.

Database API reference →

One call gets you the current VPN IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.

download()
Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.
downloadUrl()
The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.
downloadBytes()
The build in memory, for a small dataset or a pipeline that never touches a filesystem.
metadata()
Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.
checksums()
The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.
import os
from vpndetection import VPNDetection
client = VPNDetection(os.environ["VPNDETECTION_API_KEY"])
# to disk, streamed
client.database.download("vpn_ip_v1", "csvgz", "vpn_ip_v1.csv.gz")
# a time-limited link
url = client.database.download_url("vpn_ip_v1", "csvgz")
# in memory
raw = client.database.download_bytes("vpn_ip_v1", "csvgz")
download.pypip install vpndetection
Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

What it's used for

Three decisions VPN IP is bought for, and what each needs from the data rather than from a score.

Stop account sharing and region hopping

Knowing the service, not just that a VPN is present, lets you treat a privacy-conscious customer differently from a bulk abuse network.

Tune rules per operator

Provider ids are stable across builds, so a rule you write against one service keeps working as its ranges rotate.

Explain the decision

Confidence and last seen give a support team something concrete to say when a legitimate customer is challenged.

License the full database
Sales will quote on volume, term and whether you need redistribution rights.
Checksums published per file: md5, sha1, sha256 and sha512.
The id pins the schema version, so a new build never changes the columns your parser reads.
Samples are cut from the current build, not a synthetic extract.

Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.

On this page

What does a row tell us?

One range observed as a commercial VPN's exit, the provider that operates it, how sure we are of the observation, and the last day it was made. IPv4 and IPv6 are in the same file.

00 · No key

Start without signing up.

Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.

curl "https://api.vpndetection.io/146.70.116.130"
{
"ip": "146.70.116.130",
"is_vpn": true
}
01 · Free key

Sign up and get 50,000 requests a month.

No card and no sales call: the key is issued on signup.
Every request flags VPN IPs.
Upgrade only when you outgrow the allowance.