On this page
Blocking datacenter IPs is the first thing most teams try against VPN traffic. A VPN server has to live somewhere, and blocking cloud and hosting ranges takes one WAF rule. In the Hacker News thread on Utah's SB 73, whose VPN provision a federal judge enjoined on September 24, one engineer described how that went at work:
"IP from a datacenter" doesn't work in practice to detect VPNs. [...] We had to disable that rule almost immediately because a large majority of VDI (Virtual Desktop Infrastructure) solutions are hosted in or at least egress from big cloud providers.
We measured both halves of that: how many VPN exits a hosting check catches, and what else it blocks. We took the 1,203,469 IPv4 addresses our VPN IP database had as commercial VPN exits on 2026-09-29, and checked each against every IPv4 range in our Hosting IP database from the same day.
A check on Hosting IP's high confidence ranges caught 65.0% of them, and one that takes in its medium ranges too caught 85.3%. Blocking everything in the Hosting IP database covers 810.7M addresses, about 790 for each VPN exit it catches.
What a hosting check catches
| Where the exit sits | IPv4 | Share |
|---|---|---|
| AWS, Azure or Google Cloud | 11,401 | 0.9% |
| Another cloud or hosting company's network | 639,075 | 53.1% |
| A VPN company's own server network | 132,038 | 11.0% |
A medium confidence range | 244,118 | 20.3% |
| No hosting range | 176,837 | 14.7% |
The first three rows are the high confidence ranges. The third depends on the list: we count a VPN company's own server network as hosting, and a list that doesn't catches 54.0%.
The fourth row is the medium ones. The last row compares with IPinfo's 16.4% on non-hosting networks, measured in December 2025 on 370,616 VPN IPs of its own.
What it blocks along the way
What each part of the Hosting IP database covers, and how many VPN exits are in it:
| Blocked | IPv4 addresses | VPN exits in it | Addresses per exit |
|---|---|---|---|
| AWS, Azure and Google Cloud | 301.4M | 11,401 | 26,439 |
| Every other cloud and hosting network | 114.3M | 771,113 | 148 |
medium confidence ranges | 395.0M | 244,118 | 1,618 |
| All of it | 810.7M | 1,026,632 | 790 |
The three largest clouds are 37.2% of the hosting address space and hold 0.9% of VPN exits. Blocking them stops almost no VPN traffic, and it's the part of the rule that cut off the engineer's virtual desktop users.
The medium ranges carry a cost of their own. They hold 63.7% of the addresses iCloud Private Relay sends traffic from, 67,932 of the 106,692 IPv4 in our Relay IP database. Hosting ranges at either level hold 18.6% of Cisco Secure Web Gateway's, the proxy many companies send their staff's browsing through. A Safari user with Private Relay on and an employee behind their company's gateway both look like datacenter traffic to a check that takes in medium.
The exits outside hosting space
Of the 176,837 exits in no hosting range, 15,402 (8.7%) belong to peer-based services, which run on their participants' own connections at consumer ISPs, most of them in Japan, Korea and Thailand. Others sit in research and education networks, where one national network alone carries 36,608, and in networks that VPN and network-security companies run under their own names. Only a VPN list catches these.
Using them together
Give each database its own job. Block on VPN IP: a hit is a VPN exit, with the provider named. Score on Hosting IP, whose confidence column says how sure we are that a range is hosting. Weigh a high hit above a medium one, and check Relay IP first, so a Private Relay user doesn't pick up a datacenter score.
All three are rebuilt daily, as gzipped CSV and as MMDB, so every lookup runs in your own process with no call out per request.
How we measured
We used all three databases as built on 2026-09-29, IPv4 only. The VPN side is every address our VPN IP database attributed to a named commercial provider at our highest confidence tier that day, 1,315,945, less the ones that only take connections in rather than send traffic out: 1,203,469 exits. Business VPN services are left out, as they are from the VPN IP v1 export.
The Hosting IP database is a curated catalog of hosting and cloud providers plus our own classification and scanning of datacenter networks. The cloud rows are its aws, azure and gcp providers.
To license the databases, see pricing or talk to us.
