VPN exit ranges, attributed to the operator.
Address ranges observed terminating a commercial VPN tunnel, each with the operator that runs it and how strongly the observation is supported, white-label fleets resold under other brands included.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ and MMDB. For how each range was established, see VPN IP Extended.
| start_ip | end_ip | provider | confidence | last_seen |
|---|---|---|---|---|
| 216.131.87.112 | 216.131.87.127 | ipvanish | high | 2026-09-08 |
| 208.85.18.71 | 208.85.18.71 | tunnelbear | high | 2026-09-07 |
| 187.13.129.184 | 187.13.129.187 | nordvpn | high | 2026-09-07 |
| 172.235.240.0 | 172.235.240.11 | metrovpn_net | medium | 2026-09-04 |
| 95.170.13.20 | 95.170.13.23 | pingvpn_pingsecure | low | 2026-06-16 |
The operators behind the IDs.
provider is an ID that holds from build to build. VPN Provider resolves each one to the operator's name and homepage, whether we track its addresses, the features it advertises and whether it has gone defunct. Join it on provider.
| id | name | url | active | features | note | defunct |
|---|---|---|---|---|---|---|
| nordvpn | NordVPN | https://nordvpn.com/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|dedicated_nodes|exit_node_selection|streaming_unblocking|paid | f | |
| mullvad | Mullvad | https://mullvad.net/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|exit_node_selection|paid | f | |
| tunnelbear | TunnelBear | https://www.tunnelbear.com/ | t | no_logging_policy|torrent_allowed|kill_switch|exit_node_selection|free|paid | f |
Downloading it from code.
Database API reference →One call gets you the current VPN IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("vpn_ip_v1")client.database.download("vpn_ip_v1", "mmdb", "./vpn_ip_v1.mmdb")sums = client.database.checksums("vpn_ip_v1", "mmdb")print(meta.updated, meta.entries, sums["sha256"])
Where it occurs.
VPN IP holds 16,784,718 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.
By country
Of the 16,784,718 IP Geolocation places.
- United States2,797,996 · 16.67%
- Germany2,117,983 · 12.62%
- Japan1,922,031 · 11.45%
- China1,095,978 · 6.53%
- United Kingdom726,198 · 4.33%
- Russia545,136 · 3.25%
- Canada384,535 · 2.29%
- France382,434 · 2.28%
- Brazil379,290 · 2.26%
- The Netherlands370,669 · 2.21%
By network
Each /24 counted for the AS announcing most of it.
- AS14061DigitalOcean, LLC398,096 · 2.37%
- AS4134CHINANET-BACKBONE374,845 · 2.23%
- AS4837CHINA UNICOM China169 Backbone348,765 · 2.08%
- AS88811&1 Versatel GmbH348,409 · 2.08%
- AS7922Comcast Cable Communications, LLC323,261 · 1.93%
- AS2514NTT PC Communications, Inc.306,109 · 1.82%
- AS212238Datacamp Limited305,425 · 1.82%
- AS16509Amazon.com, Inc.297,892 · 1.77%
- AS2527Sony Network Communications Inc.290,731 · 1.73%
- AS9009M247 Europe SRL271,286 · 1.62%
Getting your hands on it.
Teams join VPN IP against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Rules and scoring
Join the rows against traffic you already log and score a session on the operator and the confidence, rather than on one boolean.
Account and payment risk
Signals at signup and checkout, where the answer has to be local and consistent.
Network and abuse operations
Attribute what is hitting you to the infrastructure behind it, with provider IDs that stay stable as ranges rotate.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
What does a row tell us?
One range observed as a commercial VPN's exit, the provider that operates it, how sure we are of the observation, and the last day it was made. IPv4 and IPv6 are in the same file.
What does confidence mean?
high, medium or low: how sure we are that the range is the provider's. It's graded by how reliable the evidence behind the range has proven for that provider, so the same kind of evidence can earn high for one provider and low for another.
Are provider IDs stable?
Yes. An ID stays the same across builds, so a rule written against an operator keeps working as its ranges rotate. The VPN Provider catalog names each one, with its features and whether it is defunct.
Does it cover white-label VPNs?
Yes, though each address carries one provider. Where brands resell or share one fleet, its addresses are published under one of them.
What does VPN IP Extended add?
The same ranges with a method column recording how each was established, scan, scrape, registry or infer, for weighing ranges by the kind of evidence behind them.
How often is it rebuilt?
Daily. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV and MMDB, both cut from the same build. The MMDB opens in any MaxMind DB reader.
How do we get it?
Under a Standard or Redistribution license, quoted per database. Get a quote names VPN IP to us, and Request evaluation puts the full current build in your hands to test first. Download sample gets you rows from it now.
Is there a lookup API?
No. You download VPN IP and query it in your own systems, so nothing is metered and no address leaves them. Each build comes from the database API, or to your webhook or your own storage. One address at a time, its page on this site shows what VPN IP holds for it.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.