Skip to content
InternetData

Hosting and datacenter space, by provider.

Ranges that belong to hosting, cloud and datacenter providers, attributed to the company that operates them. Most other anonymity signals sit on top of this layer.

Request evaluation

Schema at a glance.

See documentation →

The schema and metadata are in the docs. It is published as CSVGZ and MMDB.

start_ipend_ipproviderconfidencelast_seen
69.195.69.069.195.70.255unifiedlayerhigh2026-09-06
188.221.236.0188.221.236.255m247high2026-09-06
121.196.177.0121.196.177.255alibabahigh2026-09-06
45.38.3.045.38.3.2553hcloudhigh2026-09-06
2603:c011:8000::2603:c011:8fff:ffff:ffff:ffff:ffff:fffforaclehigh2026-09-06
ID
hosting_ip_v1
Entries
467,027
Refresh
Daily
CSVGZ
3.17 MB
MMDB
5.71 MB
Hosting Provider

The operators behind the IDs.

Hosting Provider documentation →

provider is an ID that holds from build to build. Hosting Provider resolves each one to the operator's name and homepage, whether we track it, and the kinds of hosting it sells. Join it on provider.

idnameurlactivekindnote
awsAmazon Web Serviceshttps://aws.amazon.com/tcloud
hetznerHetzner Onlinehttps://www.hetzner.com/tdedicated|vps|cloud
m247M247https://www.m247.com/tcolo|dedicated
ID
hosting_provider_v1
Entries
927

Downloading it from code.

Database API reference →

One call gets you the current Hosting IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.

download()
Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.
downloadUrl()
The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.
downloadBytes()
The build in memory, for a small database or a pipeline that never touches a filesystem.
metadata()
Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.
checksums()
The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.
import os
from internetdata import InternetData
client = InternetData(os.environ["INTERNETDATA_API_KEY"])
# what is in today's build, without moving the file
meta = client.database.metadata("hosting_ip_v1")
client.database.download("hosting_ip_v1", "mmdb", "./hosting_ip_v1.mmdb")
sums = client.database.checksums("hosting_ip_v1", "mmdb")
print(meta.updated, meta.entries, sums["sha256"])
load.pypip install internetdata
Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Where it occurs.

Hosting IP holds 480,821,907 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.

By country

Of the 480,821,907 IP Geolocation places.

  1. United States254,455,896 · 52.92%
  2. China29,905,365 · 6.22%
  3. Germany24,324,704 · 5.06%
  4. Japan14,732,773 · 3.06%
  5. The Netherlands12,927,306 · 2.69%
  6. United Kingdom12,495,588 · 2.60%
  7. Singapore11,899,616 · 2.47%
  8. Ireland9,537,037 · 1.98%
  9. Hong Kong9,361,089 · 1.95%
  10. France8,854,473 · 1.84%

By network

Each /24 counted for the AS announcing most of it.

  1. AS16509Amazon.com, Inc.157,564,672 · 32.77%
  2. AS8075Microsoft Corporation80,761,088 · 16.80%
  3. AS396982Google LLC22,024,960 · 4.58%
  4. AS14618Amazon.com, Inc.21,575,168 · 4.49%
  5. AS37963Hangzhou Alibaba Advertising Co.,Ltd.9,620,992 · 2.00%
  6. AS20940Akamai International B.V.7,652,607 · 1.59%
  7. AS45090Shenzhen Tencent Computer Systems Company Limited6,173,440 · 1.28%
  8. AS31898Oracle Corporation5,709,824 · 1.19%
  9. AS45102Alibaba (US) Technology Co., Ltd.5,651,200 · 1.18%
  10. AS16276OVH SAS4,665,344 · 0.97%

Getting your hands on it.

Teams join Hosting IP against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.

Rules and scoring

Join the rows against traffic you already log and score a session on the operator and the confidence, rather than on one boolean.

Account and payment risk

Signals at signup and checkout, where the answer has to be local and consistent.

Network and abuse operations

Attribute what is hitting you to the infrastructure behind it, with provider IDs that stay stable as ranges rotate.

License the full database
Sales will quote on volume, term and whether you need redistribution rights.
Checksums published per file: md5, sha1, sha256 and sha512.
The ID fixes the schema, so a new build never changes the columns your parser reads.
Samples are cut from the current build, not a synthetic extract.

An official client for every major language.

All SDKs on GitHub →

Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.

On this page

What does a row tell us?

One range that belongs to a hosting, cloud or datacenter provider, the provider's ID, how sure we are of it and the last day it was observed.

00 · Evaluate

Test the real build first.

An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.

Request evaluation
01 · License

Then license what you use.

Standard, for detection and decisions inside your own product and operations.
Redistribution, when the data ships onward inside what you sell, priced by scope rather than by seat.
Annual terms, a named contact, and monthly, quarterly or yearly payment.