VPN Datasets
The VPN Server Datasets provide the list of active IPs and networks providing consumer VPN services. This page documents the dataset structure, features, and update schedule. For background information on VPN and the dataset see the dataset information page.
- See It
- Browse VPNs
- Learn About It
- Dataset overview
- Update Frequency
- Daily between 19:00 and 19:30 UTC
Dataset Samples
We have provided dataset samples for the Hide.me VPN service.
| Sample | Description |
|---|---|
| Hide.me VPN - JSON | Detailed JSON data |
| Hide.me VPN - Text | Simple plain text list |
You can find links to information on authentication, response codes, and other developer topics in the menu. An API key or token from a subscription is required to access the links below.
Choosing the Right Dataset: Aggregated vs. Detailed
Selecting the appropriate dataset depends on your operational goals. If your objective is broad firewall filtering or enforcing Quality of Service (QoS) policies, the Aggregated Dataset provides a consolidated, resource-efficient list of VPN network blocks and IP addresses.
If your use case requires granular analysis or specific policy exemptions - such as routing general VPN traffic while explicitly allowing Apple iCloud Private Relay - the Detailed Dataset is the better choice. It allows you to apply precise rules and custom policies tailored to individual VPN providers.
If your goal is to identify all VPN IPs and networks while making a best-effort attempt to identify the specific VPN application, using both datasets can provide the best coverage. For example, check an IP against the Detailed Dataset first. If no match is found, fall back to the Aggregated Dataset. This approach combines provider-level identification with the broader coverage of the aggregated data.
Detailed Dataset
In the detailed dataset, VPN IP addresses and network blocks are organized by individual VPN application, with approximately 80 VPN applications tracked independently. This makes it possible to identify the specific VPN provider associated with an IP address. However, it also means that adjacent or overlapping IP ranges belonging to different VPN applications must remain separate. This creates a larger dataset, especially on hosting networks where multiple VPN providers operate within the same larger address block.
Aggregated Dataset
The aggregated dataset takes a broader view. For example, a hosting provider such as M247 may have different portions of the same /24 network - containing 256 IP addresses - used by Proton VPN, CyberGhost VPN, UrbanVPN, and other VPN services. In the aggregated dataset, these IP addresses and network blocks can be evaluated collectively as VPN infrastructure, regardless of the specific VPN application. Adjacent ranges can therefore be consolidated into larger, more efficient network blocks.
Downloads
Aggregated Dataset
Detailed Dataset
Status and VPN Application List
Payload Formats
Aggregated Format
JSON Dataset
The vpns_aggregated.json.gz dataset provides the list of networks and IPs used by all consumer VPN services.
The cidr_list information provides a list of a network blocks dedicated to consumer VPN. Keep in mind, there might different brands of VPNs in a single network block. For example, 203.0.113.0/24 might contain VPN services for Proton VPN, CyberGhost VPN, and UrbanVPN.
The ip_list contains detailed information on well-known VPN IPs both inside and outside of the cidr_list network blocks. IP data includes the application information for the service (e.g., NordVPN) along with extended VPN attributes.
In addition, the standard IP information from the IP Object is provided:
- ASN
- Network
- Platform (Hosting)
- Hostname
- Geolocation
For example, 2.58.74.0/24 is a provided in the cidr_list . The ip_list also provides detailed information on NordVPN server IP: 2.58.74.18 (hr50.nordvpn.com). The vpn_cidr attribute for the IP address provides a cross-reference to the 2.58.74.0/24 network block (see example).
Aggregated VPN Dataset - JSON
"cidr_list": [
{
"network": "2.56.252.0/24",
"version": "ipv4"
},
...
],
"ip_list": [
{ IP Object with VPN Info },
{ IP Object with VPN Info },
...
]Aggregated VPN IP with vpn_cidr
{
"address": "45.9.250.38",
"version": "ipv4",
"shared_score": 1,
"vpn_cidr": "45.9.250.0/26",
...
}Aggregated Plain Text List
The vpns_aggregated.txt dataset provides a simple text file list of all the VPN IPs and networks. There are no network overlaps in this list - it as an efficient list intended for firewall, routers, and IP sets.
Aggregated VPN Dataset - Plain Text
45.9.250.0/26
149.22.82.10
149.22.82.12
...Detailed Format
JSON Dataset
The vpns.json.gz dataset provides the list of IPs and networks grouped by individual VPN providers. The data includes information on the VPN application (e.g., NordVPN) and its associated networks (cidr_list ) and IPs (ip_list ).
The IP data in the ip_list includes extended VPN attributes as well as the standard IP information in the IP Object:
- ASN
- Network
- Platform (Hosting)
- Hostname
- Geolocation
If the VPN service spans network ranges, the cidr_list information is provided. This is only provided if the network is 100% dedicated to the specific VPN service.
Please keep in mind that the IPs in ip_list may fall in the ranges of listed networks/CIDRs. For example, 2.58.74.0/24 is provided in the NordVPN cidr_list , but the dataset also provides details for the VPN server IP 2.58.74.18 (hr50.nordvpn.com). The app_cidr attribute for the IP address provides a cross-reference to the 2.58.74.0/24 network block (see example).
Detailed VPN Dataset - JSON
"application": {
"id": 10539,
"tag": "hide-me",
"label": "Hide.me VPN",
...
},
"ip_list": [
{ IP Object with VPN Info },
{ IP Object with VPN Info },
...
],
"cidr_list": [
{
"network": "2.56.252.0/24",
"version": "ipv4"
},
...
]Detailed VPN IP with app_cidr
{
"address": "2.58.74.181",
"version": "ipv4",
"shared_score": 1,
"app_cidr": "2.58.74.0/24",
...
}IP Plain Text List
The vpns.txt dataset provides a simple text file list of all the VPN IPs and networks in the detailed dataset. There are no network overlaps in this list, but it is larger than the aggregated dataset.
Detailed VPN Dataset - Plain Text
138.199.57.46
149.22.82.10
149.22.82.12
...