2026-09-04

IP lookups read the providers' own range feeds

Named cloud providers and VPN services, iCloud Private Relay detection, operator-declared locations, and IPv6 coverage for the datacenter, VPN and relay flags.

POST /api/v1/ip now consults the published ranges of AWS, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Linode, Vultr, Cloudflare and Fastly next to the open X4BNet lists. hosting_provider names the provider when the address is inside its own feed.
Known VPN exits carry a name: privacy_service says Mullvad, NordVPN or Private Internet Access when that provider's server list contains the address.
is_relay flags iCloud Private Relay egress addresses from Apple's own list, with privacy_service set to iCloud Private Relay. Relay adds 10 to risk_score, and the datacenter weight is skipped for relay addresses because their egress sits on CDN infrastructure by design. Relay egress also appears in the aggregate VPN list, so is_vpn answers false there unless a VPN provider's own list names the address.
Where the network operator publishes the location itself (RFC 8805 geofeeds, Apple's relay list, VPN server lists), that declaration overrides the database answer and location_source says operator; when it disagrees with the database, region, latitude and longitude are null rather than a contradicting value.
asn_type classifies the network as hosting, isp, education or government from the flags and the operator name, and stays null when it cannot tell.
The datacenter, VPN and relay flags are evaluated for IPv6 wherever a feed covers it. Only the Tor exit list is IPv4-only, so is_tor stays null for IPv6.
sources gains relay-ranges; each group's version is the oldest sync date among its feeds. Every feed syncs daily.

markdown version: /changelog/2026-09-04-ip-network-feeds.md · atom feed: /changelog.atom

All releases