# Does blocking datacenter IPs stop VPNs?

We checked 1.2M VPN exits against our Hosting IP database. A hosting check catches 85% of them and blocks 790 addresses for each one.

Blocking datacenter IPs is the first thing most teams try against VPN traffic. A VPN server has to live somewhere, and blocking cloud and hosting ranges takes one WAF rule. In the Hacker News thread on Utah's SB 73, whose VPN provision a federal judge [enjoined on September 24](https://gizmodo.com/federal-judge-blocks-utahs-vpn-crackdown-2000818450), one engineer [described how that went](https://news.ycombinator.com/item?id=47999847) at work:

> "IP from a datacenter" doesn't work in practice to detect VPNs. [...] We had to disable that rule almost immediately because a large majority of VDI (Virtual Desktop Infrastructure) solutions are hosted in or at least egress from big cloud providers.

We measured both halves of that: how many VPN exits a hosting check catches, and what else it blocks. We took the 1,203,469 IPv4 addresses our [VPN IP](https://internetdata.io/databases/vpn-ip) database had as commercial VPN exits on 2026-09-29, and checked each against every IPv4 range in our [Hosting IP](https://internetdata.io/databases/hosting-ip) database from the same day.

A check on Hosting IP's `high` confidence ranges caught 65.0% of them, and one that takes in its `medium` ranges too caught 85.3%. Blocking everything in the Hosting IP database covers 810.7M addresses, about 790 for each VPN exit it catches.

## What a hosting check catches

| Where the exit sits | IPv4 | Share |
|---|---|---|
| AWS, Azure or Google Cloud | 11,401 | 0.9% |
| Another cloud or hosting company's network | 639,075 | 53.1% |
| A VPN company's own server network | 132,038 | 11.0% |
| A `medium` confidence range | 244,118 | 20.3% |
| No hosting range | 176,837 | 14.7% |

The first three rows are the `high` confidence ranges. The third depends on the list: we count a VPN company's own server network as hosting, and a list that doesn't catches 54.0%.

The fourth row is the `medium` ones. The last row compares with IPinfo's [16.4% on non-hosting networks](https://ipinfo.io/blog/vpns-isp-based-ip-infrastructure), measured in December 2025 on 370,616 VPN IPs of its own.

## What it blocks along the way

What each part of the Hosting IP database covers, and how many VPN exits are in it:

| Blocked | IPv4 addresses | VPN exits in it | Addresses per exit |
|---|---|---|---|
| AWS, Azure and Google Cloud | 301.4M | 11,401 | 26,439 |
| Every other cloud and hosting network | 114.3M | 771,113 | 148 |
| `medium` confidence ranges | 395.0M | 244,118 | 1,618 |
| All of it | 810.7M | 1,026,632 | 790 |

The three largest clouds are 37.2% of the hosting address space and hold 0.9% of VPN exits. Blocking them stops almost no VPN traffic, and it's the part of the rule that cut off the engineer's virtual desktop users.

The `medium` ranges carry a cost of their own. They hold 63.7% of the addresses iCloud Private Relay sends traffic from, 67,932 of the 106,692 IPv4 in our [Relay IP](https://internetdata.io/databases/relay-ip) database. Hosting ranges at either level hold 18.6% of Cisco Secure Web Gateway's, the proxy many companies send their staff's browsing through. A Safari user with Private Relay on and an employee behind their company's gateway both look like datacenter traffic to a check that takes in `medium`.

## The exits outside hosting space

Of the 176,837 exits in no hosting range, 15,402 (8.7%) belong to peer-based services, which run on their participants' own connections at consumer ISPs, most of them in Japan, Korea and Thailand. Others sit in research and education networks, where one national network alone carries 36,608, and in networks that VPN and network-security companies run under their own names. Only a VPN list catches these.

## Using them together

Give each database its own job. Block on [VPN IP](https://docs.internetdata.io/database/vpn-ip/vpn-ip): a hit is a VPN exit, with the provider named. Score on [Hosting IP](https://docs.internetdata.io/database/hosting-ip/hosting-ip), whose `confidence` column says how sure we are that a range is hosting. Weigh a `high` hit above a `medium` one, and check [Relay IP](https://docs.internetdata.io/database/relay-ip/relay-ip) first, so a Private Relay user doesn't pick up a datacenter score.

All three are rebuilt daily, as gzipped CSV and as MMDB, so every lookup runs in your own process with no call out per request.

## How we measured

We used all three databases as built on 2026-09-29, IPv4 only. The VPN side is every address our VPN IP database attributed to a named commercial provider at our highest confidence tier that day, 1,315,945, less the ones that only take connections in rather than send traffic out: 1,203,469 exits. Business VPN services are left out, as they are from the VPN IP v1 export.

The Hosting IP database is a curated catalog of hosting and cloud providers plus our own classification and scanning of datacenter networks. The cloud rows are its `aws`, `azure` and `gcp` providers.

To license the databases, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).