An offline IP lookup database of VPN CIDRs and bad actor IP ranges. Updated daily.

Project contains:

• An SQLite3 database containing IP ranges of datacenters, IPs used for malicious activities, ASNs and countries
• Same plain-text files are available under /dist folder.

Existing solutions to detect VPNs/Proxies revolve around providing HTTP APIs or binary databases on a subscription model. Downsides of the existing projects are:

• Extremely expensive
• Not portable
• Not fast enough

This database is:

• Free
• Portable (SQLite3)
• Sufficiently fast

Some ISPs/Telecoms, while not being exactly hosting providers, might still provide mobile VPN services on specific IP addresses, which is not easy to detect. These are often covered in paid solutions.

Using black-listed IPs lists together with datacenter IP lists covers some of the bases, as those IPs are often used for malicious purposes and end up blacklisted eventually.

• The ASNs (manually) deducted from this list of Datacenters
• The ASNs from these lists were added
• The ASNs deducted (automatically, during build) from NordVPN's server list IPs
• List of all ASNs names is matched against keywords that would give away datacenters or hosting

False positives are possible.

Below is the approximate number of rows in each of the database tables. Each row contains IP or IP range in an integer notation (first and last IPs).

Pick some random IPs:

sort -R dist/datacenters.netset | head -n 5

Check against any of the known IP scoring services:

• https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/1.1.1.1
• https://www.ip2location.com/demo/1.1.1.1
• https://scamalytics.com/ip/1.1.1.1

The project is provided with an example NodeJS library to query the database, but you are not limited to the programming language, since SQLite database is highly portable.

Run the example file:

node ./src/example.js

Output:

init: 46.245ms
Datacenter: false
Blacklisted: true
Country: de
Is EU: true
Asn: { id: 3320, name: 'Deutsche Telekom AG' }
queries: 21.886ms

In case you really want to build the project yourself, you would need a NodeJS/NPM environment.

Install dependencies:

npm run deps:install

Start the build process, which would take up to a minute to complete.

TOKEN={IP2LOCATION_DOWNLOAD_TOKEN} npm run db:build

The TOKEN for the underlying ASN database could be issued with your free ip2location account.

• Firehol
• ip2location ASN DB
• This list of DC names
• This list of ASNs
• This list of web-hosting companies
• NordVPN API

• This product includes IP2Location LITE data available from http://www.ip2location.com.
• This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.