On this page
Two of the threads we flagged last issue moved this cycle. Provider coverage kept climbing (now 279 commercial VPNs, up 46), and the deeper scanning we said we were testing is now in production and contributing attributed addresses. On top of that, the provider catalogs themselves now ship as their own downloadable databases.
New: provider catalogs
Four provider catalogs now download as databases of their own: curated brand catalogs that complement the IP data. Each row carries the provider ID, name, URL, and an active flag, and the ID lines up with the provider attribution in the matching IP database, so you can join them directly. Download each with its dataset ID, same as any other database.
- VPN provider catalog,
vpn_provider_v1. The authoritative list of commercial VPN brands we track: 719 providers cataloged, 279 currently covered with IP data. Joins against VPN IP. - Hosting provider catalog,
hosting_provider_v1. 111 curated hosting providers (such as OVH or Hetzner) that back our Hosting IP database. - CDN provider catalog,
cdn_provider_v1. The CDN brands behind our CDN IP database (Akamai, Cloudflare, Fastly, Amazon CloudFront, Gcore, and more). - Relay provider catalog,
relay_provider_v1. The privacy-relay and managed-egress operators in our Relay IP database (Apple iCloud Private Relay, Google One VPN, and others).
All four ship in the same CSV.GZ format as the IP databases.
Database at a glance
| Metric | Jun 10 | Jun 25 | Δ |
|---|---|---|---|
| Commercial providers covered | 233 | 279 | +46 (+19.7%) |
| High-confidence ranges | 968,634 | 982,099 | +13,465 (+1.4%) |
| High-confidence IPv4 addresses | 1,071,738 | 1,035,459 | -36,279 (-3.4%, provider churn) |
| IPv6 addresses covered | 3.41 × 10³⁰ | 4.05 × 10³⁰ | +18.6% (low/medium-confidence) |
| Total distinct ranges | 11,828,536 | 12,811,831 | +983,295 (+8.3%) |
| Total IPv4 addresses | 19,456,036 | 15,945,113 | -3,510,923 (-18.0%, scan noise removal) |
What changed behind the scenes
- A new scanning method for full provider coverage went live. Last issue we said we were testing a way to catch all of a provider's IPv4 servers, beyond what our existing per-provider scanning reaches. It is now in production and contributing provider-attributed addresses across nine providers, with more being added as the rollout continues. The addresses it surfaces are ones our existing scanning had not, even for providers we already covered deeply:
- StrongVPN: +4,623
- ProtonVPN: +1,357
- Surfshark: +399
- Windscribe: +141
- hide.me: +30
- 46 more providers, now 279. The app and browser-extension reverse-engineering pipeline kept finding new commercial VPNs, the largest single-cycle gain since we started this newsletter.
Provider churn
New this issue: how much the labeled high-confidence set turns over. We measure churn only on provider-attributed, high-confidence ranges; the lower-confidence tiers move too much due to inference to read as real provider churn. Across the window we added about 255,300 of these ranges and retired about 241,800, so roughly a quarter of the labeled high-confidence set cycled in two weeks even though the net change is small. That gross movement is why a point-in-time list goes stale fast. A few of the larger per-provider moves, in high-confidence IPv4:
- TunnelBear: down about 29.4% (142,493 to 100,642 addresses) after retiring a large block. Inference may have had an effect here too.
- IPVanish: down about 11.4% (9,135 to 8,097).
- Surfshark: up about 6.0% (21,791 to 23,089).
- Windscribe: up about 5.0% (10,647 to 11,182).
- PureVPN: down about 2.3% (27,920 to 27,265).
Hosting IP
We rebuilt how Hosting IP classifies datacenter networks, allowing us to better classify networks and name them reliably as well. Total IPv4 coverage grew about +20% to over 740 million addresses, while ranges consolidated for cleaner, less fragmented output. The new hosting provider catalog (above) is part of the same effort.
