Free IP databases: the eight Open ones and what each is for

Eight of our databases are Open: free to download with any account, under CC BY-SA 4.0. They're rebuilt daily, documented column by column like the rest, and come the same ways: the console, the API and its clients, and BigQuery. Each is small enough to keep wherever you look up an address. The largest, IP Country Flag, is a 7.24 MB download.

ASN: who runs a network

One row per allocated AS number: the holder, its country, registry and allocation date, its domain, our classification of the network it runs, the IPv4 space and prefixes it announces, and its routes by RPKI state. 86,388 of the 123,137 announce space.

Join it to the AS numbers you already have, from flow logs, a BGP feed or IP ASN, to tell an ISP's subscribers from a cloud's servers and a company's own network, or to see how much of a network's space RPKI covers.

Anycast IP: addresses with no single place

4,330 IPv4 ranges covering 10,865,152 addresses, and 1,809 IPv6 ranges, each answered from many locations at once: 1.1.1.0/24, 8.8.8.0/24 and 9.9.9.0/24, the public DNS resolvers, among them. Check it before trusting a city, a latency figure or an abuse report for one of these addresses. Geolocation can't pin it to one place, two round-trip times to it can both be right, and its traffic belongs to a network rather than a machine.

Bogon IP and Bogon ASN: what should never appear

80 IPv4 and IPv6 ranges reserved for private networks, loopback, documentation and other special uses, each named, and 14 ranges of AS numbers reserved the same way, each with IANA's description. Neither belongs on the public internet: a packet from a bogon address is misconfigured or spoofed, and a route or record naming a bogon AS number is a leak or a mistake. Drop them at the edge, and filter them out before an address reaches an allowlist, a report or a model. Our bogon page lists every range with the RFC that reserves it.

Tor IP: every Tor node

13,133 rows, 10,506 IPv4 and 2,627 IPv6, rebuilt daily from the public Tor network: every node, not only its exits, with the day each was last seen. A login or a checkout from one is worth a second look rather than a block, and a connection from inside your own network to one is someone there running Tor.

Relay IP: privacy relays, kept apart from VPNs

11,909 ranges from Apple's iCloud Private Relay, Google's VPN services and Cisco's Secure Web Gateway. Their users are mostly people who turned on a privacy setting, or employees behind their company's gateway, so a rule written for VPNs and proxies shouldn't catch them: match Relay IP first and treat a hit as relayed traffic. Should you block iCloud Private Relay? has what blocking it costs. Relay Provider, Open with it, resolves each row's provider to the service's name and homepage.

IP Country Flag and IP Country Currency

907,180 IPv4 and IPv6 ranges each, across 252 countries and territories, with the country IP Geolocation gives the same range. IP Country Flag adds the flag as an emoji and as its Unicode code points, U+1F1EA U+1F1F8 for Spain, for a system that can't render emoji. IP Country Currency adds the currency's ISO 4217 code, name and symbol. Together they open a country picker on the visitor's flag and a checkout in their currency, from a file you hold.

Getting them

Sign up, and every Open database is in the console with a download button, already licensed to your organization: nothing to request. With an API key, the CLI and the client libraries download them as they do any database:

internetdata db download tor_ip_v1

In BigQuery, subscribe to the free InternetData Open listing, or InternetData Open EU, and every table keyed by address comes with a function that looks one up inline (BigQuery has the details):

SELECT
    l.ip,
    internetdata_open.ip_country_flag_v1(l.ip).country AS country,
    internetdata_open.tor_ip_v1(l.ip).confidence AS tor,
    internetdata_open.relay_ip_v1(l.ip).provider AS relay
FROM mydataset.logins AS l

CC BY-SA 4.0 asks two things: credit InternetData with a link to internetdata.io, and share what you build from the data under the same license. Building it into something you sell without sharing alike takes a redistribution license, and the rest of what we publish is on the databases page, most with a sample to evaluate.