beta

API

Every page is built from these endpoints. Send an API key as Authorization: Bearer vpndb_…; create one under Account.

This page

GET /api/v1/meta

curl -s -H 'Authorization: Bearer vpndb_EXAMPLE_NOT_A_REAL_KEY' \
  '/api/v1/meta'
Open raw JSON in a new tab ↗
All endpoints
GET /api/v1/ip/{ip}Who operates an address
GET /api/v1/ip/{ip}/historyEvery week of an address
GET /api/v1/prefix/{cidr}Any range, and who is inside it
GET /api/v1/prefix/{cidr}/addressesEvery address of a prefix, in a window
GET /api/v1/prefix/{cidr}/timelineHow a prefix was probed, day by day
GET /api/v1/asn/{asn}A network and its providers
GET /api/v1/asn/{asn}/networksEvery prefix of a network
GET /api/v1/org/{id}A company and all its networks
GET /api/v1/org/{id}/networksEvery prefix of a company
GET /api/v1/country/{cc}The infrastructure located in a country
GET /api/v1/countriesEvery country at a glance
GET /api/v1/service/{tag}A provider's profile
GET /api/v1/service/{tag}/networksEvery network a provider exits from
GET /api/v1/servicesEvery provider at a glance
POST /api/v1/bulkMany addresses at once
GET /api/v1/searchResolve free text
GET /api/v1/suggestSuggestions as you type
GET /api/v1/metaThe dataset
GET /api/v1/openapi.yamlThis specification
GET /api/v1/sourcesWhere the data comes from
API documentationOpenAPI specification
Sign in
Getting started
What VPNDB answers
One question, answered with evidence: whose VPN or proxy infrastructure operates behind this address, prefix or network.
VPNDB answers one question. For an IP address, a prefix or an autonomous system: which VPN or proxy provider operates behind it, with what probability, and on what evidence.
The evidence clause is the operative one. Comparable services report that an address is anonymised. VPNDB reports whose infrastructure it is, the confidence in that attribution, and the basis for it, so the answer can be assessed against the decision it will support.
What makes it different
  • Provider distribution per network. For an ASN or prefix, the share of observed addresses per provider. AS136787 resolves to NordVPN at 99.9 %; AS9009 carries 25 providers, led by CyberGhost at 41.6 %.
  • Method recorded on every claim. probe, scan, cert, interpolated, feed.
  • Certificate attribution. VPN operators run their own certificate authority and identify themselves in the issuer field.
  • Virtual locations. Advertised server location against observed egress location.
  • Time series. 8.0 million observations since November 2024, supporting point-in-time, churn and trend analysis rather than a current snapshot alone.
What it deliberately does not do
Client behaviour, device type, concentration and spread require traffic telemetry that is not collected and is not planned. These fields are omitted rather than estimated.
AS9009A network carrying 25 providers.Open →