Which services are in it?

Apple iCloud Private Relay, Google's VPNs, and web gateways such as Cisco's and Zscaler's among them. The Relay Provider catalog names every provider ID.

Where do the ranges come from?

From the lists the operators publish of their own egress, never inferred. A range stays for 90 days after its operator last listed it, and last_seen says when that was.

Open

Relay and gateway egress, told apart from VPN.

Egress address space for privacy relays such as Apple Private Relay and Google's VPN, and for enterprise web gateways such as Zscaler, kept separate so ordinary phone and office traffic never lands in a VPN rule.

Schema at a glance.

See documentation →

The schema and metadata are in the docs. It is published as CSVGZ and MMDB.

start_ip	end_ip	provider	confidence	last_seen
2a02:26f7:b550:4000::	2a02:26f7:b550:4000:ffff:ffff:ffff:ffff	apple_private_relay	high	2026-09-06
2a02:26f7:e7c2:4000::	2a02:26f7:e7c2:4000:ffff:ffff:ffff:ffff	apple_private_relay	high	2026-09-06
2606:40:21dc:4000::	2606:40:21dc:43ff:ffff:ffff:ffff:ffff	google_vpn	high	2026-09-06
2606:40:219a:2000::	2606:40:219a:23ff:ffff:ffff:ffff:ffff	google_vpn	high	2026-09-06
2a02:26f7:ef00:59d9::	2a02:26f7:ef00:59da:ffff:ffff:ffff:ffff	apple_private_relay	high	2026-09-06

relay_ip_v1

Entries

176,777

Refresh

Daily

CSVGZ

1.14 MB

MMDB

1.07 MB

Relay Provider

The operators behind the IDs.

Relay Provider documentation →

provider is an ID that holds from build to build. Relay Provider resolves each one to the service's name and homepage, and whether we track it. Join it on provider.

id	name	url	active	note
apple_private_relay	Apple iCloud Private Relay	https://www.apple.com/icloud/	t
google_vpn	Google One VPN	https://one.google.com/about/vpn/	t
cisco_secure_web_gateway	Cisco Secure Web Gateway	https://www.cisco.com/site/us/en/products/security/secure-web-gateway/	t	Enterprise managed egress (Umbrella).

relay_provider_v1

Entries

Downloading it from code.

Database API reference →

One call gets you the current Relay IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.

download()

Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.

downloadUrl()

The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.

downloadBytes()

The build in memory, for a small database or a pipeline that never touches a filesystem.

metadata()

Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.

checksums()

The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.

import os
from internetdata import InternetData
 
client = InternetData(os.environ["INTERNETDATA_API_KEY"])
 
# what is in today's build, without moving the file
meta = client.database.metadata("relay_ip_v1")
 
client.database.download("relay_ip_v1", "mmdb", "./relay_ip_v1.mmdb")
sums = client.database.checksums("relay_ip_v1", "mmdb")
print(meta.updated, meta.entries, sums["sha256"])

load.pypip install internetdata

Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Where it occurs.

Relay IP holds 2,344,417 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.

By country

Of the 2,344,417 IP Geolocation places.

United States974,059 · 41.55%
Switzerland174,281 · 7.43%
India104,084 · 4.44%
Germany84,347 · 3.60%
Japan83,503 · 3.56%
United Kingdom78,115 · 3.33%
The Netherlands74,731 · 3.19%
Australia73,232 · 3.12%
Canada51,347 · 2.19%
Singapore50,911 · 2.17%

By network

Each /24 counted for the AS announcing most of it.

AS22616ZSCALER, INC.413,184 · 17.62%
AS55256Netskope Inc190,976 · 8.15%
AS62044Zscaler Switzerland GmbH182,272 · 7.77%
AS36692Cisco OpenDNS, LLC157,194 · 6.71%
AS53813ZSCALER, INC.142,336 · 6.07%
AS13335Cloudflare, Inc.91,041 · 3.88%
AS394089Google LLC85,922 · 3.66%
AS8075Microsoft Corporation73,755 · 3.15%
AS396982Google LLC70,093 · 2.99%
AS13150CATO NETWORKS LTD63,744 · 2.72%

Getting your hands on it.

Free with an account, and the file is yours: teams join Relay IP against the traffic, logs and routing data they already hold, inside their own infrastructure.

Rules and scoring

Join the rows against traffic you already log and score a session on the operator and the confidence, rather than on one boolean.

Account and payment risk

Signals at signup and checkout, where the answer has to be local and consistent.

Network and abuse operations

Attribute what is hitting you to the infrastructure behind it, with provider IDs that stay stable as ranges rotate.

Free with an account

Checksums published per file: md5, sha1, sha256 and sha512.

The ID fixes the schema, so a new build never changes the columns your parser reads.

An official client for every major language.

All SDKs on GitHub →

Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.

Node.js Python Go Java .NET PHP Ruby Rust Swift Erlang Perl Zig

Questions.

Read the docs →API reference →Email support →

On this page

How is a relay different from a VPN?

A relay is built into an operating system, a browser or a company's web gateway, so its users are mostly ordinary people with a privacy feature switched on, or at work behind their company's gateway. It's kept apart from VPN IP so a VPN rule doesn't catch them.