beta

API

Every page is built from these endpoints. Send an API key as Authorization: Bearer vpndb_…; create one under Account.

This page

GET /api/v1/meta

curl -s -H 'Authorization: Bearer vpndb_EXAMPLE_NOT_A_REAL_KEY' \
  '/api/v1/meta'
Open raw JSON in a new tab ↗
All endpoints
GET /api/v1/ip/{ip}Who operates an address
GET /api/v1/ip/{ip}/historyEvery week of an address
GET /api/v1/prefix/{cidr}Any range, and who is inside it
GET /api/v1/prefix/{cidr}/addressesEvery address of a prefix, in a window
GET /api/v1/prefix/{cidr}/timelineHow a prefix was probed, day by day
GET /api/v1/asn/{asn}A network and its providers
GET /api/v1/asn/{asn}/networksEvery prefix of a network
GET /api/v1/org/{id}A company and all its networks
GET /api/v1/org/{id}/networksEvery prefix of a company
GET /api/v1/country/{cc}The infrastructure located in a country
GET /api/v1/countriesEvery country at a glance
GET /api/v1/service/{tag}A provider's profile
GET /api/v1/service/{tag}/networksEvery network a provider exits from
GET /api/v1/servicesEvery provider at a glance
POST /api/v1/bulkMany addresses at once
GET /api/v1/searchResolve free text
GET /api/v1/suggestSuggestions as you type
GET /api/v1/metaThe dataset
GET /api/v1/openapi.yamlThis specification
GET /api/v1/sourcesWhere the data comes from
API documentationOpenAPI specification
Sign in
Evidence
Certificate attribution
VPN operators identify themselves in their own certificates. The issuer and subject fields are read.
Commercial VPN operators run a private certificate authority for their server fleet and identify themselves in the issuer field.
Certificate fieldExampleTells us
issuer.common_nameCyberGhost Root CAThe operator
issuer.organizationPrivate Internet AccessThe operator
subject.common_nameparis-rack410.nodes.gen4.ninjaOften the site — here, Paris
Attribution independent of probing: it applies to hosts never routed through. It has also identified providers absent from the probing configuration; TorGuard, with several thousand addresses, was found this way.
Claimed against observed location
The subject name frequently encodes the advertised site. Compared against the observed egress location, this yields virtual server locations: a host presenting as Paris that responds from Frankfurt. See Virtual locations.