Hosting and datacenter space, by provider.
Ranges that belong to hosting, cloud and datacenter providers, attributed to the company that operates them. Most other anonymity signals sit on top of this layer.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ and MMDB.
| start_ip | end_ip | provider | confidence | last_seen |
|---|---|---|---|---|
| 69.195.69.0 | 69.195.70.255 | unifiedlayer | high | 2026-09-06 |
| 188.221.236.0 | 188.221.236.255 | m247 | high | 2026-09-06 |
| 121.196.177.0 | 121.196.177.255 | alibaba | high | 2026-09-06 |
| 45.38.3.0 | 45.38.3.255 | 3hcloud | high | 2026-09-06 |
| 2603:c011:8000:: | 2603:c011:8fff:ffff:ffff:ffff:ffff:ffff | oracle | high | 2026-09-06 |
The operators behind the IDs.
provider is an ID that holds from build to build. Hosting Provider resolves each one to the operator's name and homepage, whether we track it, and the kinds of hosting it sells. Join it on provider.
| id | name | url | active | kind | note |
|---|---|---|---|---|---|
| aws | Amazon Web Services | https://aws.amazon.com/ | t | cloud | |
| hetzner | Hetzner Online | https://www.hetzner.com/ | t | dedicated|vps|cloud | |
| m247 | M247 | https://www.m247.com/ | t | colo|dedicated |
Downloading it from code.
Database API reference →One call gets you the current Hosting IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("hosting_ip_v1")client.database.download("hosting_ip_v1", "mmdb", "./hosting_ip_v1.mmdb")sums = client.database.checksums("hosting_ip_v1", "mmdb")print(meta.updated, meta.entries, sums["sha256"])
Where it occurs.
Hosting IP holds 480,821,907 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.
By country
Of the 480,821,907 IP Geolocation places.
- United States254,455,896 · 52.92%
- China29,905,365 · 6.22%
- Germany24,324,704 · 5.06%
- Japan14,732,773 · 3.06%
- The Netherlands12,927,306 · 2.69%
- United Kingdom12,495,588 · 2.60%
- Singapore11,899,616 · 2.47%
- Ireland9,537,037 · 1.98%
- Hong Kong9,361,089 · 1.95%
- France8,854,473 · 1.84%
By network
Each /24 counted for the AS announcing most of it.
- AS16509Amazon.com, Inc.157,564,672 · 32.77%
- AS8075Microsoft Corporation80,761,088 · 16.80%
- AS396982Google LLC22,024,960 · 4.58%
- AS14618Amazon.com, Inc.21,575,168 · 4.49%
- AS37963Hangzhou Alibaba Advertising Co.,Ltd.9,620,992 · 2.00%
- AS20940Akamai International B.V.7,652,607 · 1.59%
- AS45090Shenzhen Tencent Computer Systems Company Limited6,173,440 · 1.28%
- AS31898Oracle Corporation5,709,824 · 1.19%
- AS45102Alibaba (US) Technology Co., Ltd.5,651,200 · 1.18%
- AS16276OVH SAS4,665,344 · 0.97%
Getting your hands on it.
Teams join Hosting IP against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Rules and scoring
Join the rows against traffic you already log and score a session on the operator and the confidence, rather than on one boolean.
Account and payment risk
Signals at signup and checkout, where the answer has to be local and consistent.
Network and abuse operations
Attribute what is hitting you to the infrastructure behind it, with provider IDs that stay stable as ranges rotate.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
What does a row tell us?
One range that belongs to a hosting, cloud or datacenter provider, the provider's ID, how sure we are of it and the last day it was observed.
What does confidence mean?
high or medium: how sure we are that the range is hosting space, medium being less sure than high.
Can we tell cloud from bulletproof hosting?
Yes. Join provider onto the Hosting Provider catalog, whose kind column separates cloud, VPS, dedicated, colocation and bulletproof operators.
Does a hosting address mean a bot?
Not by itself. It means the address is infrastructure rather than a residential line, where VPN exits, proxies and crawlers live alongside ordinary servers. Weigh it with what else you know.
How often is it rebuilt?
Daily. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV and MMDB, both cut from the same build. The MMDB opens in any MaxMind DB reader.
How do we get it?
Under a Standard or Redistribution license, quoted per database. Get a quote names Hosting IP to us, and Request evaluation puts the full current build in your hands to test first. Download sample gets you rows from it now.
Is there a lookup API?
No. You download Hosting IP and query it in your own systems, so nothing is metered and no address leaves them. Each build comes from the database API, or to your webhook or your own storage. One address at a time, its page on this site shows what Hosting IP holds for it.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.