beta

API

Every page is built from these endpoints. Send an API key as Authorization: Bearer vpndb_…; create one under Account.

This page

GET /api/v1/meta

curl -s -H 'Authorization: Bearer vpndb_EXAMPLE_NOT_A_REAL_KEY' \
  '/api/v1/meta'

All endpoints

GET /api/v1/ip/{ip}Who operates an address
GET /api/v1/ip/{ip}/historyEvery week of an address
GET /api/v1/prefix/{cidr}Any range, and who is inside it
GET /api/v1/prefix/{cidr}/addressesEvery address of a prefix, in a window
GET /api/v1/prefix/{cidr}/timelineHow a prefix was probed, day by day
GET /api/v1/asn/{asn}A network and its providers
GET /api/v1/asn/{asn}/networksEvery prefix of a network
GET /api/v1/org/{id}A company and all its networks
GET /api/v1/org/{id}/networksEvery prefix of a company
GET /api/v1/country/{cc}The infrastructure located in a country
GET /api/v1/countriesEvery country at a glance
GET /api/v1/service/{tag}A provider's profile
GET /api/v1/service/{tag}/networksEvery network a provider exits from
GET /api/v1/servicesEvery provider at a glance
POST /api/v1/bulkMany addresses at once
GET /api/v1/searchResolve free text
GET /api/v1/suggestSuggestions as you type
GET /api/v1/metaThe dataset
GET /api/v1/openapi.yamlThis specification
GET /api/v1/sourcesWhere the data comes from
API documentationOpenAPI specification
Sign in

Entities

Providers

Provider footprint: size, countries, networks, protocols, trend and status.

Providers in the header lists every provider our probing has reached, VPN and residential proxy: exit addresses across the record and in the last 30 days, the announced prefixes holding them, the networks announcing them, and the countries they sit in by the DB-IP table — where the exits are, not what the provider advertises. Sort on any column; the figures are recomputed after each sync.

Profiles one provider: address count, geographic distribution, networks, observed protocols and how each has changed over time.

Status is derived from volume, not recency

StatusMeans
ACTIVECurrent volume is in line with its own history
DEGRADEDStill seen, but far below its own median — something has broken
DISCONTINUEDNothing in the last 30 days

A provider observed twice yesterday that previously delivered five hundred addresses a month is DEGRADED, regardless of how recent the last timestamp is. Mullvad is the current example: three addresses in thirty days against a history of hundreds.