VPN exit ranges, with how each was established.
Every range in VPN IP with one column more, method: scan where we spoke the VPN protocol to the address ourselves, scrape where the operator published it, registry where registration or naming records attribute it, and infer where it was extrapolated from confirmed neighbors in the same block. A scan row with no provider is confirmed VPN infrastructure not yet tied to a named operator.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ and MMDB. Every column but method is VPN IP's.
| start_ip | end_ip | provider | method | confidence | last_seen |
|---|---|---|---|---|---|
| 167.99.128.103 | 167.99.128.103 | tunnelbear | scrape | high | 2026-09-16 |
| 12.233.41.154 | 12.233.41.154 | watchguard | scan | low | 2026-07-28 |
| 2001:ac8:25:400:1012:78a1:d496:566f | 2001:ac8:25:400:1012:78b1:6c83:6aa5 | ovpn | infer | high | 2026-10-08 |
| 1.221.118.116 | 1.221.118.116 | scan | low | 2026-10-04 | |
| 4.38.88.206 | 4.38.88.206 | scan | low | 2026-10-05 |
The operators behind the ids.
provider is an id that holds from build to build. VPN Provider resolves each one to the operator's name and homepage, whether we track its addresses, the features it advertises and whether it has gone defunct. Join it on provider.
| id | name | url | active | features | note | defunct |
|---|---|---|---|---|---|---|
| nordvpn | NordVPN | https://nordvpn.com/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|dedicated_nodes|exit_node_selection|streaming_unblocking|paid | f | |
| mullvad | Mullvad | https://mullvad.net/ | t | no_logging_policy|torrent_allowed|kill_switch|multihop|exit_node_selection|paid | f | |
| tunnelbear | TunnelBear | https://www.tunnelbear.com/ | t | no_logging_policy|torrent_allowed|kill_switch|exit_node_selection|free|paid | f |
Downloading it from code.
Database API reference →One call gets you the current VPN IP Extended build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("vpn_ip_extended_v1")client.database.download("vpn_ip_extended_v1", "mmdb", "./vpn_ip_extended_v1.mmdb")sums = client.database.checksums("vpn_ip_extended_v1", "mmdb")print(meta.updated, meta.entries, sums["sha256"])
Getting your hands on it.
Teams join VPN IP Extended against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Weighting by evidence
Score a range on the kind of evidence behind it as well as its confidence, where one grade is too coarse.
Account and payment risk
Signals at signup and checkout, where the answer has to be local and consistent.
Network and abuse operations
Attribute what is hitting you to the infrastructure behind it, with provider ids that stay stable as ranges rotate.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
What does a row tell us?
One range observed as VPN infrastructure: the provider that operates it, the method that established it, how strongly the observation is supported, and the last build that saw it. IPv4 and IPv6 are in the same file.
What do the method values mean?
scan: we spoke the VPN's protocol to the address and got a valid server response. scrape: the provider published the address, through its API, client software, configuration, DNS or website. registry: registration and naming records attribute the range to the provider. infer: the address sits in a small block where we confirmed enough of the provider's addresses to extend to the rest.
Why is provider empty on some rows?
The range is confirmed VPN infrastructure that isn't tied to a named provider yet. It may be attributed later, or it may be non-commercial, a corporate VPN among them.
Does method replace confidence?
No. The same method can earn different confidence for different providers: infer can be right almost every time for one provider's leased blocks and a guess for another's. Weigh the two together.
Will new method values appear?
No. New ways of finding ranges are folded into these four, so a rule that switches on them stays correct as coverage grows.
How often is it rebuilt?
Daily. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV and MMDB, both cut from the same build. Poll the metadata call first and fetch only when the build has changed.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.