VPN & Tor Exit Node Database

Covers the IP infrastructure behind commercial VPN services, Tor relays, and high-abuse individual IPs detected across multiple independent threat signals. VPN provider attribution is derived from ASN ownership data — when a network range is registered directly to a known VPN operator, the provider is identified. Ranges hosted on shared infrastructure (M247, Datacamp, Clouvider) show the ISP name only, since dozens of VPN services co-exist on those ASNs and single-provider attribution would be misleading.

Each entry in this database originates from one of four classification pipelines. Entries from multiple pipelines are deduplicated by source priority: Tor exit nodes take precedence over VPN ranges, which take precedence over general threat intel. The result is a single canonical classification per IP, not duplicated rows across categories.

Column definitions

IP / CIDR

Network range or individual IP. CIDR notation like 185.220.101.0/24 means the entire /24 subnet is confirmed VPN or Tor infrastructure — not a single flagged host within it.

Provider

The VPN service linked to this range via ASN ownership. Populated only when the ASN is registered exclusively to a VPN operator. Shared hosting ASNs leave this blank; the ISP column shows the actual network operator.

ISP

The autonomous system (AS) that announces this IP block via BGP. For provider-owned ASNs this matches the provider. For leased infrastructure it shows the hosting company (e.g. M247, Zenlayer, Serverius).

Country

The country where this block is registered or routed. For VPN and Tor nodes this is the server location, not the user behind it. Operators pick jurisdictions deliberately for legal and routing reasons.

Classification

VPN — confirmed commercial VPN exit range. Tor Exit Node — routes Tor circuit traffic to the public internet; connections originating here have already left the anonymity network. Tor Relay — in-network hop only; does not initiate external connections. Threat Intel — individual IP corroborated by 3 or more independent blocklists.

How classification works

The pipeline runs four concurrent feeds, then merges results into a single canonical entry per IP. When an IP appears in multiple categories, the classification priority is: Tor Exit > VPN Range > Threat Intel > Tor Relay. This prevents double-counting and ensures the most security-relevant label wins.

Threat Intel entries require cross-feed corroboration: only IPs flagged by 3 or more independent blocklists are included. Single-source flags are excluded to reduce false positives from stale or low-quality feeds.

Use cases

Access control

Block or flag signups, logins, and purchases originating from VPN exit nodes and Tor exits. Reduces chargebacks, credential stuffing, and account fraud where real identity matters.

Analytics hygiene

Filter VPN and Tor traffic from product analytics pipelines. A single power user cycling VPN exit nodes can inflate session counts and skew conversion funnels significantly.

Fraud scoring

Feed into a composite risk signal alongside velocity checks, device fingerprinting, and behavioural patterns. A VPN hit alone is not fraud — combined with other signals it materially shifts the probability.

Security ops

Enrich SIEM events and WAF logs. An inbound connection from a Tor exit node or a known Threat Intel IP warrants elevated scrutiny regardless of the payload.

VPN providers with direct ASN attribution (19 identified)

Attribution is best-effort. Providers that lease IP space from shared hosting companies appear under the hosting ISP. Full VPN coverage requires active server enumeration, which goes beyond what BGP/ASN data alone supports. The list above represents confirmed operator-to-ASN mappings only.

Intelligence sources

VPN ranges

BGP-derived CIDR list of known VPN server ranges, built from routing analysis and active server enumeration. Updated continuously by the community.

Tor exit nodes

Official bulk exit node list from the Tor Project — the authoritative record of IPs that can originate Tor exit traffic at any given time.

Tor relay nodes

Full Tor relay registry including relay fingerprint, IP address, and OR port. Covers in-network relays that do not appear on the exit list.

Threat intel

Multi-source blacklist aggregator. Each contributing feed runs independently; an IP that survives the 3-feed threshold has been confirmed hostile by multiple organisations with no coordination between them.