Smarter VPN Detection, Better VPN Datasets
New VPN detection techniques in the Netify DPI Agent are uncovering more VPN infrastructure than ever before. That visibility flows directly into more accurate VPN datasets, including our new Aggregated VPN Dataset.
Why VPN IP Lists Go Stale
Consumer VPNs serve a legitimate purpose: they protect personal privacy on untrusted networks. But for schools, libraries, enterprises, and managed service providers, an unmanaged VPN tunnel is a blind spot that can bypass content filtering, security controls, and compliance policies. The most common first line of defense is a list of known VPN IP addresses and networks, which is simple, efficient, and able to flag VPN traffic before a connection is even established.
The catch is that a VPN IP list is only as good as the methods used to discover the IPs in it. VPN providers constantly add and rotate servers, many brands share address space on the same hosting providers, and a growing number of VPN clients use obfuscation to blend in with ordinary web traffic. A list built purely from public server directories or external scanning will always lag behind.
That is why our VPN datasets start somewhere else entirely: inside the network, at the packet level.
Detection Starts at the Packet
The Netify DPI Agent uses a layered approach to VPN and tunnel detection. Each layer catches traffic the previous one cannot.
Protocol and Application Signatures
The core DPI engine identifies tunneling protocols such as IPsec, OpenVPN, WireGuard, and PPTP from their handshakes, packet structures, and transport behavior. On its own, a WireGuard tunnel looks the same whether it belongs to NordVPN, a competing provider, or a self-hosted server. Netify correlates the tunnel with the other application flows from the same device, such as the VPN client's login, API calls, and server list lookups that happen just before the tunnel comes up. Linking these flows is an important step in VPN analysis: it turns "WireGuard to an unknown IP address" into "NordVPN over WireGuard" and ties that server endpoint to a specific VPN provider.
The Netify Intelligence Engine
Protocol and application detection is just the start. Modern VPN clients increasingly use port evasion, encryption, and traffic camouflage to defeat signature-based detection. The Intelligence engine adds new layers designed specifically for these evasive services.
Machine learning and AI-assisted techniques are used to support signature development and enhance dynamic analysis. These systems help identify emerging VPN patterns, accelerate signature creation, and improve detection coverage for previously unseen or rapidly evolving tunneling technologies.
From Packets to Datasets
Here is where detection and data come together. Netify DPI agents are deployed across thousands of live networks worldwide, so they observe VPN connections from inside the network, where users actually connect, rather than from the outside looking in. Every time the agent identifies a VPN session, it also learns something about the server on the other end.
Those detections are combined with DNS, ASN, and hosting provider data, targeted scanning, and machine learning to build the Netify VPN datasets, which are refreshed daily. As the agent's detection techniques improve, the datasets improve with them:
- Broader Coverage
- Obfuscated and lesser-known VPN services are discovered through real-world traffic.
- Fresher Data
- New VPN servers are picked up as soon as they carry traffic, and the datasets are updated every day.
- Better Attribution
- Application-level detection ties IPs to specific VPN brands, even on shared hosting infrastructure.
You can explore the results for yourself on our VPN resources page, which covers the VPN applications we track along with their server and hosting infrastructure.
Introducing the Aggregated VPN Dataset
Better discovery also revealed a practical problem. VPN providers cluster heavily on the same hosting networks, and a per-provider list has to keep adjacent ranges belonging to different brands separate. To make large-scale filtering simpler and more efficient, the VPN data is now available in two forms.
Detailed Dataset
VPN IPs and networks are organized by individual VPN application, with approximately 80 VPN applications tracked independently. Use it when you need to know which VPN provider is behind an IP address, or when you want per-provider policies, such as blocking consumer VPNs while allowing Apple iCloud Private Relay.
Aggregated Dataset
VPN infrastructure is treated as a whole, regardless of brand. A single block of IP addresses at a hosting provider like M247 might be shared by Proton VPN, CyberGhost VPN, and UrbanVPN, so adjacent ranges are consolidated into larger, more efficient network blocks.
Built for Firewalls and IP Sets
The aggregated plain text list contains no overlapping networks, which makes it a compact, drop-in source for firewalls, routers, IP sets, and QoS policies. The aggregated JSON version adds a cross-reference from well-known VPN server IPs to the network block they belong to, along with application, ASN, hosting, hostname, and geolocation details.
Learn More
For the technical details, see the VPN dataset documentation and the Network Intelligence feature overview. To talk about VPN detection for your network or platform, contact our team at hello@netify.ai.