# VPN IP Report #4 (June 25 to August 3)

75 more commercial VPN providers covered, and a new extended database that tells you what kind of evidence backs every range.

75 more commercial VPN providers added, the largest gain so far. The new deep scanning methods we were rolling out are complete and mature, some of the most important VPN providers have their entire fleets covered almost without exception, and the provider long tail keeps growing. There is also a new database that exposes what kind of evidence sits behind every range: `vpn_ip_extended_v1`.

## New: documentation for every database

We launched a documentation site for our databases: [docs.internetdata.io/database](https://docs.internetdata.io/database). Every database now has its own page covering the schema, the available formats, and the download ID. For [VPN IP](https://internetdata.io/databases/vpn-ip):

- [docs.internetdata.io/database/vpn-ip](https://docs.internetdata.io/database/vpn-ip)
- [docs.internetdata.io/database/vpn-ip/vpn-ip](https://docs.internetdata.io/database/vpn-ip/vpn-ip)
- [docs.internetdata.io/database/vpn-ip/vpn-ip-extended](https://docs.internetdata.io/database/vpn-ip/vpn-ip-extended)
- [docs.internetdata.io/database/vpn-ip/vpn-provider](https://docs.internetdata.io/database/vpn-ip/vpn-provider)

Hosting IP, CDN IP, Relay IP, and Tor IP are all documented there too.

## New: evidence classes and the extended database

Until now, every range in VPN IP came with a provider and a confidence tier, but not with the reason we believe it. That reason is now a published column, and it ships in a new database alongside the one you already download: `vpn_ip_extended_v1`, in both CSV.GZ and MMDB. It carries the same columns as `vpn_ip_v1` plus one more, `method`, an evidence class with four values. Each value and what it means is documented at [docs.internetdata.io/database/vpn-ip/vpn-ip-extended](https://docs.internetdata.io/database/vpn-ip/vpn-ip-extended).

Worth knowing up front: `method` and `confidence` answer different questions. Confidence is how sure we are the address is a VPN address at all. `method` is how we found out. Two ranges can share a confidence tier and still deserve different treatment in your rules.

## Database at a glance

| Metric | Jun 25 | Aug 3 | Δ |
| --- | ---: | ---: | --- |
| Commercial providers covered | 279 | 354 | +75 (+26.9%) |
| High-confidence IPv4 addresses | 1,035,459 | 1,119,956 | +84,497 (+8.2%) |
| High-confidence ranges | 982,099 | 920,100 | -61,999 (-6.3%, consolidation) |
| IPv6 addresses covered | 4.05 × 10³⁰ | 4.05 × 10³⁰ | essentially flat |
| Total distinct ranges | 12,811,831 | 15,932,495 | +3,120,664 (+24.4%) |
| Total IPv4 addresses | 15,945,113 | 17,647,676 | +1,702,563 (+10.7%) |

High-confidence rows count the addresses and ranges we attribute to a specific provider at our highest confidence tier.

## What changed behind the scenes

- **Deep scans now attribute fleets we could not reach before.** Many VPN servers from the biggest providers were previously not so easily reachable for various reasons. We've finished rolling out new scanning methods that reliably fingerprint and identify all of the IPs of a provider available on the internet - currently we're covering up to 50+ providers with this method.
- **75 more providers, now 354.** Our reverse-engineering pipeline has allowed us to rapidly land lots of new brands including Mix VPN, UT Loop, LinkLayer VPN, Touch VPN and others.
- **Large gains on big providers.** Among providers already covered, the largest high-confidence IPv4 gains were Surfshark (up about 123%), CyberGhost (up about 46%), ProtonVPN (up about 21%), and HideMyAss (up roughly ninefold).

## VPN exits on residential proxy networks

Something we have been tracking internally and are now reporting regularly: a meaningful share of the VPN exits in this database also appear inside residential proxy networks. The same IPv4 address serves as a provider's VPN exit and, separately, as a residential proxy. If you score or block by IP, that overlap changes what a hit means.

About 187,500 of our high-confidence VPN exit addresses, roughly 6.7% of the IPv4 we attribute to commercial VPN providers, also operate on residential proxy networks. Where it concentrates, as a share of each provider's whole IPv4 pool:

| Provider | Overlapping IPv4 | Provider's IPv4 | Share |
| --- | ---: | ---: | ---: |
| NordVPN | 81,992 | 244,329 | 33.6% |
| FastVPN | 4,988 | 15,730 | 31.7% |
| IPVanish | 1,963 | 13,320 | 14.7% |
| Private Internet Access | 12,950 | 106,543 | 12.2% |
| ProtonVPN | 12,942 | 110,338 | 11.7% |

Peer-based services such as VPN Gate sit high on this measure as well, at about 33%, but that is inherent to running on participant connections rather than operator-owned infrastructure, so we do not rank them alongside conventional providers.

Overlap counts distinct IPv4 addresses that are both a provider's high-confidence VPN exit and present in residential proxy networks over a rolling window; the per-provider share is that count over the provider's whole IPv4 pool. Co-occurrence reflects shared address use, not a confirmed arrangement between operators.

## Hosting, CDN, Relay and Tor IP

- **Hosting IP.** IPv4 coverage grew about 6.1% to over 787 million addresses, and the hosting provider catalog nearly doubled, from 111 to 194 named providers. We also rebuilt how IPv6 hosting space is classified, moving it onto our own datacenter-ASN classification and scanning. That deliberately shrank the unlabeled IPv6 pool while increasing the addresses we can actually name.
- **CDN, Relay, and Tor IP** were steady this cycle.