IP Anonymity Report: August 2026

The provider catalog stopped being just a name-and-homepage lookup this month. vpn_provider_v2 adds a per-provider features column carrying 26 documented policy and capability flags, from logging policy and kill-switch support through to the ones that matter for risk scoring: which providers run on peer or residential infrastructure, and which we have citable evidence to flag as malicious or bulletproof-hosted.

VPN IP

What changed

• The provider catalog now describes each provider, not just names it. vpn_provider_v2 ships in CSV.GZ alongside the v1 you already pull, adding features and note. features is a pipe-separated set drawn from a fixed, documented vocabulary of 26 flags, and we set it across the full catalog of 1,431 commercial VPN providers we track, not only the 454 we currently publish IP data for. The distribution gives a sense of it: 796 providers offer exit-node selection, 762 are paid and 586 free, 668 advertise a no-logging policy, 276 ship a kill switch, 174 permit torrenting. The smaller counts are the interesting ones for scoring: 52 providers run on peer-to-peer infrastructure, 19 openly sell residential IP addresses, 12 are flagged as known malicious and 5 as bulletproof-hosted. We only set a flag on an explicit positive signal, so an absent flag means "not established", not "false". Your existing key already grants it. Schema and the full vocabulary: docs.internetdata.io/database/vpn-ip/vpn-provider.
• 100 more providers, now 454, and not only in the long tail. Last issue we said to expect the covered count to keep climbing, weighted toward smaller and regional brands. It climbed, but the notable additions this time were mainstream: Firefox's built-in VPN, Avira Phantom VPN, and an expansion of Mullvad's coverage onto address ranges we previously could not reach. TeknoVPN, TrendVPN, Triple Ape VPN, Line VPN and Elyx VPN came in from the regional tail alongside them.
• Enterprise egress is now identified and held out of your feed. A few providers in the catalog are not consumer VPNs, they're corporate secure web gateways and enterprise egress services. They carry the enterprise_vpn flag, and the vpn_ip_v1 download filters them out, but in a future vpn_ip_v2 we'll start including them, so you can join against vpn_provider_v2's new features column to filter them out if you wish.

Residential Proxy IP

The 129 active providers break down as 127 residential, 3 mobile, and 7 datacenter, with some contributing across categories.

The pool crossed over to IPv4

On August 13 the residential pool held more IPv4 addresses than IPv6 for the first time since May. IPv4 went from 66,996,070 to 68,902,181, up 2.8%, growing on every single day of the window. IPv6 went from 68,345,046 to 61,680,581, down 9.8%. The -3.5% headline is those two pulling against each other.

The IPv6 side is still the same network aging out of the 90-day window that we described last issue, and it accounts for essentially all of the v6 loss. As usual, treat a lot of the v6 half as a fast-moving inventory rather than a settling one.

Inside the residential pool

As of August 31, 43.9% of residential IPs were seen exactly once (25.9% of IPv4, 64.1% of IPv6) and 41.1% appeared under more than one provider (64.0% of IPv4, 15.4% of IPv6). IPv4 lifetime kept the stickiness it picked up last month, median 6.4 days with the 75th percentile at 42.3 days; IPv6 remains a flat one day at both.

What changed

• The proxy provider catalog gets a note column. resproxy_provider_v2 ships in CSV.GZ alongside v1, adding a free-text note per provider. Your existing key already grants it. Schema: docs.internetdata.io/database/resproxy-ip/resproxy-provider.

Cross-database: VPN exits on residential proxy networks

193,304 of our high-confidence VPN exit addresses (about 6.1% of the IPv4 we attribute to commercial VPN providers) also operate on residential proxy networks, against 187,508 and 6.7% last issue.

Every share above fell against last issue, NordVPN from 33.6% and ProtonVPN from 11.7%.

Overlap counts distinct IPv4 addresses that are both a provider's high-confidence VPN exit and present in residential proxy networks over a rolling window; the per-provider share is that count over the provider's whole IPv4 pool. Peer-based reads the p2p_infrastructure flag from vpn_provider_v2: those providers run on participant connections rather than operator-owned infrastructure, so a high share is inherent. Co-occurrence reflects shared address use, not a confirmed arrangement between operators.

Hosting IP

That's on top of last month's near-doubling. The provider catalog downloads as hosting_provider_v1.

Also this month

• Mobile Proxy IP. Up 10.9% to 4,219,761 IPs on the same three feeds. Second straight window of growth.
• Datacenter Proxy IP. Down 13.9% to 1,012,333 IPs on churn; provider count held at 7.