VPN IP Extended

Overview

VPN IP ranges with provider attribution, confidence and detection method.

curl -L -o vpn_ip_extended_v1.csv.gz -X GET "https://api.vpndetection.io/api/v1/database/download?id=vpn_ip_extended_v1&format=csvgz&apikey=$APIKEY"

Schema

Name	Type	Description
`start_ip`	`ipaddress`	Start IP of the IP range.
`end_ip`	`ipaddress`	End IP of the IP range.
`provider`	`string`	Commercial VPN provider's unique ID. Empty when the range is confirmed VPN infrastructure we have not yet attributed to a named operator.
`method`	`string`	How this range was established. Values are listed below. `scan` We spoke the VPN protocol to the address ourselves and got a valid server response. `scrape` The operator published the address through its own API, client or configuration. `registry` Public registration or naming records attribute the address to the operator. `infer` The address was extrapolated from confirmed neighbours in the same block.
`confidence`	`string`	Confidence of the correctness of this observation.
`last_seen`	`date`	Last time this observation was made.

Samples

start_ip	end_ip	provider	method	confidence	last_seen
`152.171.7.236`	`152.171.7.236`	`draytek`	`scan`	`low`	`2026-08-28`
`76.53.164.2`	`76.53.164.2`	`watchguard`	`scan`	`low`	`2026-09-22`
`186.132.148.30`	`186.132.148.30`	`draytek`	`scan`	`low`	`2026-08-13`
`172.238.64.96`	`172.238.64.143`	`psiphon`	`infer`	`medium`	`2026-09-29`
`2001:ac8:23:500:1012:5db5:7fb3:53a2`	`2001:ac8:23:500:1012:5db5:7fb3:53a2`	`ovpn`	`scan`	`high`	`2026-09-29`

curl -L -o vpn_ip_extended_v1.mmdb -X GET "https://api.vpndetection.io/api/v1/database/download?id=vpn_ip_extended_v1&format=mmdb&apikey=$APIKEY"

Schema

Name	Type	Description
`provider`	`string`	Commercial VPN provider's unique ID. Empty when the range is confirmed VPN infrastructure we have not yet attributed to a named operator.
`method`	`string`	How this range was established. Values are listed below. `scan` We spoke the VPN protocol to the address ourselves and got a valid server response. `scrape` The operator published the address through its own API, client or configuration. `registry` Public registration or naming records attribute the address to the operator. `infer` The address was extrapolated from confirmed neighbours in the same block.
`confidence`	`string`	Confidence of the correctness of this observation.
`last_seen`	`date`	Last time this observation was made.

Samples

provider	method	confidence	last_seen
`draytek`	`scan`	`low`	`2026-08-28`
`watchguard`	`scan`	`low`	`2026-09-22`
`draytek`	`scan`	`low`	`2026-08-13`
`psiphon`	`infer`	`medium`	`2026-09-29`
`ovpn`	`scan`	`high`	`2026-09-29`