beta

API

Every page is built from these endpoints. Send an API key as Authorization: Bearer vpndb_…; create one under Account.

This page

GET /api/v1/meta

curl -s -H 'Authorization: Bearer vpndb_EXAMPLE_NOT_A_REAL_KEY' \
  '/api/v1/meta'
Open raw JSON in a new tab ↗
All endpoints
GET /api/v1/ip/{ip}Who operates an address
GET /api/v1/ip/{ip}/historyEvery week of an address
GET /api/v1/prefix/{cidr}Any range, and who is inside it
GET /api/v1/prefix/{cidr}/addressesEvery address of a prefix, in a window
GET /api/v1/prefix/{cidr}/timelineHow a prefix was probed, day by day
GET /api/v1/asn/{asn}A network and its providers
GET /api/v1/asn/{asn}/networksEvery prefix of a network
GET /api/v1/org/{id}A company and all its networks
GET /api/v1/org/{id}/networksEvery prefix of a company
GET /api/v1/country/{cc}The infrastructure located in a country
GET /api/v1/countriesEvery country at a glance
GET /api/v1/service/{tag}A provider's profile
GET /api/v1/service/{tag}/networksEvery network a provider exits from
GET /api/v1/servicesEvery provider at a glance
POST /api/v1/bulkMany addresses at once
GET /api/v1/searchResolve free text
GET /api/v1/suggestSuggestions as you type
GET /api/v1/metaThe dataset
GET /api/v1/openapi.yamlThis specification
GET /api/v1/sourcesWhere the data comes from
API documentationOpenAPI specification
Sign in
Getting started
Reading a verdict
Attribution, confidence, evidence and freshness: what each component asserts.
A verdict has four components, each answering a different question. Conflating them is the most frequent misreading.
PartAnswersDoes not answer
attribution[].providerWhose infrastructureConfidence in it
attribution[].weightShare of observations attributed to themEvidential strength
confidenceEvidential strengthProvider dominance
evidence.freshnessCurrency of the observationWhether it was ever strong
Weight and confidence are independent
CyberGhost holds 41.6 % of AS9009 across 9,227 observed addresses. The weight is moderate because the network is shared; the confidence is maximal because 9,227 observations establish presence beyond doubt. Combining the two would downgrade a well-evidenced finding solely for sharing a host.
Confidence
ValueMeansThreshold
3Strong50 or more observed addresses
2Moderate5 to 49
1Weak. Corroborate before actingFewer than 5, or feed-only
Freshness
ValueOwn observationsExternal lists
freshObserved within 7 daysWithin 3× the source refresh interval
aging8 to 30 daysWithin 12×
staleOver 30 daysBeyond that