# IP lookups read the providers' own range feeds

Named cloud providers and VPN services, iCloud Private Relay detection, operator-declared locations, and IPv6 coverage for the datacenter, VPN and relay flags.

Date: 2026-09-04

- `POST /api/v1/ip` now consults the published ranges of AWS, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Linode, Vultr, Cloudflare and Fastly next to the open X4BNet lists. `hosting_provider` names the provider when the address is inside its own feed.
- Known VPN exits carry a name: `privacy_service` says Mullvad, NordVPN or Private Internet Access when that provider's server list contains the address.
- `is_relay` flags iCloud Private Relay egress addresses from Apple's own list, with `privacy_service` set to iCloud Private Relay. Relay adds 10 to `risk_score`, and the datacenter weight is skipped for relay addresses because their egress sits on CDN infrastructure by design. Relay egress also appears in the aggregate VPN list, so `is_vpn` answers false there unless a VPN provider's own list names the address.
- Where the network operator publishes the location itself (RFC 8805 geofeeds, Apple's relay list, VPN server lists), that declaration overrides the database answer and `location_source` says `operator`; when it disagrees with the database, `region`, `latitude` and `longitude` are null rather than a contradicting value.
- `asn_type` classifies the network as hosting, isp, education or government from the flags and the operator name, and stays null when it cannot tell.
- The datacenter, VPN and relay flags are evaluated for IPv6 wherever a feed covers it. Only the Tor exit list is IPv4-only, so `is_tor` stays null for IPv6.
- `sources` gains `relay-ranges`; each group's version is the oldest sync date among its feeds. Every feed syncs daily.

Reference: https://spaw.co/changelog/2026-09-04-ip-network-feeds