Every commercial VPN exit, with how it was established.
VPN IP with one column more, method: scan where we spoke the VPN protocol to the address ourselves, scrape where the operator published it, registry where registration or naming records attribute it, and infer where it was extrapolated from confirmed neighbors in the same block. Rebuilt every day.
Schema
See documentation →Published as CSVGZ and MMDB. Every column is described in the docs. Every column but method is VPN IP's.
| start_ip | end_ip | provider | method | confidence | last_seen |
|---|---|---|---|---|---|
| 167.99.128.103 | 167.99.128.103 | tunnelbear | scrape | high | 2026-09-16 |
| 12.233.41.154 | 12.233.41.154 | watchguard | scan | low | 2026-07-28 |
| 2001:ac8:25:400:1012:78a1:d496:566f | 2001:ac8:25:400:1012:78b1:6c83:6aa5 | ovpn | infer | high | 2026-10-08 |
| 1.221.118.116 | 1.221.118.116 | scan | low | 2026-10-04 | |
| 4.38.88.206 | 4.38.88.206 | scan | low | 2026-10-05 |
The operators behind the ids.
provider is an id that holds from build to build. VPN Provider resolves each one to the operator's name and homepage, whether we track its addresses, the features it advertises and whether it has gone defunct. Join it on provider.
| id | name | url | active | features | note | defunct |
|---|---|---|---|---|---|---|
| nordvpn | NordVPN | https://nordvpn.com/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|dedicated_nodes|exit_node_selection|streaming_unblocking|paid | f | |
| mullvad | Mullvad | https://mullvad.net/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|exit_node_selection|paid | f | |
| tunnelbear | TunnelBear | https://www.tunnelbear.com/ | t | no_logging_policy|torrent_allowed|kill_switch|exit_node_selection|free|paid | f |
Downloading it from code.
Database API reference →One call gets you the current VPN IP Extended build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom vpndetection import VPNDetectionclient = VPNDetection(os.environ["VPNDETECTION_API_KEY"])# to disk, streamedclient.database.download("vpn_ip_extended_v1", "csvgz", "vpn_ip_extended_v1.csv.gz")# a time-limited linkurl = client.database.download_url("vpn_ip_extended_v1", "csvgz")# in memoryraw = client.database.download_bytes("vpn_ip_extended_v1", "csvgz")
What it's used for
Three decisions VPN IP Extended is bought for, and what each needs from the data rather than from a score.
Weigh a range by its evidence
A range that answered the VPN's own protocol and one extrapolated from its neighbors can share a confidence grade. Method tells them apart.
Catch exits not yet named
A scan row with no provider is still confirmed VPN infrastructure, so a rule on method catches it before attribution does.
Rules that stay correct
Method holds four values that do not grow: a new way of finding ranges is folded into one of them, so a rule that switches on it keeps working.
Official SDKs
All SDKs on GitHub →Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.
Common questions
How often does this dataset rebuild?
Every dataset publishes its own cadence and its last build date. The proxy datasets additionally carry a rolling 90-day observation window, so first seen and last seen are relative to that window.
What does confidence mean?
How strongly the observation is supported: high, medium or low. High means direct observation through more than one method; low means a single weaker signal, and you may want to treat it differently.
Are provider ids stable?
Yes. A provider id is stable across builds so a rule you write against an operator keeps working as its ranges rotate.
Can I download the whole dataset?
With the db.download scope, as gzipped CSV or MMDB where published. Poll the metadata endpoint first and fetch only when the build has changed.
What if an address looks wrong?
Send it to support and we will tell you what we hold on it, when we last saw it and by which method. Corrections go into the next build.
Does a flag here mean I should block?
No. It means the address has that property. Whether to block is your policy, and the evidence fields are there to inform it.
Start without signing up.
Paste it into a terminal. No account needed. 1k daily allowance per user, answering ip and is_vpn.
{"ip": "45.83.91.1","is_vpn": true}