Skip to content
Spaw
Get your API key

The data behind an IP answer

Every IP answer names the datasets it read. This is the list of them: the clouds, VPN providers, relay and gateway operators whose own range files are synced, the Tor Project's exits, the registries, the threat and attack-source lists, the curated files and the two databases — each with its publisher, its terms, its size today and the fields of the answer it feeds. A source names a network or an operator, never a person.

Clouds and hosting

sourceanswerssize todaysynced
Amazon Web Servicesis_datacenter, hosting_provider, connection_type9,371 IPv4, 3,727 IPv62026-10-17
Google Cloudis_datacenter, hosting_provider, connection_type1,032 IPv4, 95 IPv62026-10-17
Microsoft Azureis_datacenter, hosting_provider, connection_type1,596 IPv4, 1,566 IPv62026-10-17
Oracle Cloudis_datacenter, hosting_provider, connection_type1,107 IPv42026-10-17
DigitalOceanis_datacenter, hosting_provider, location_source, city1,091 IPv4, 148 IPv62026-10-17
Linodeis_datacenter, hosting_provider, location_source, city5,409 IPv4, 96 IPv62026-10-17
Vultris_datacenter, hosting_provider, location_source, city447 IPv4, 58 IPv62026-10-17
Cloudflareis_datacenter, hosting_provider, is_anycast15 IPv4, 7 IPv62026-10-17
Fastlyis_datacenter, hosting_provider, is_anycast21 IPv4, 3 IPv62026-10-17
GitHub Actionsis_datacenter, hosting_provider, connection_type5,510 IPv4, 1,528 IPv62026-10-17

VPN and relay

sourceanswerssize todaysynced
Mullvadis_vpn, privacy_service, is_anonymous, location_source566 IPv4, 556 IPv62026-10-17
NordVPNis_vpn, privacy_service, is_anonymous, location_source7,202 IPv4, 1 IPv62026-10-17
Private Internet Accessis_vpn, privacy_service, is_anonymous, location_source1,630 IPv42026-10-17
IVPNis_vpn, privacy_service, is_anonymous, location_source178 IPv42026-10-17
AirVPNis_vpn, privacy_service, is_anonymous, location_source1,000 IPv4, 1,000 IPv62026-10-17
VPN Gateis_vpn, privacy_service, is_anonymous, location_source98 IPv42026-10-17
iCloud Private Relayis_relay, privacy_service, is_anonymous, location_source41,734 IPv4, 243,357 IPv62026-10-17
Cloudflare WARPinferredis_vpn, privacy_service, is_anonymous1 ASNs2026-09-12

Corporate gateways

sourceanswerssize todaysynced
Zscaleris_corporate_proxy, corporate_proxy, connection_type2,342 IPv4, 445 IPv62026-10-17

Tor

sourceanswerssize todaysynced
Tor exit listis_tor, tor_last_seen, is_anonymous4,169 IPv4, 2,131 IPv62026-10-17

Aggregate lists

sourceanswerssize todaysynced
X4BNet datacenter and VPN listsis_datacenter, is_vpn55,533 IPv4, 9,250 IPv62026-10-17

Registries and geofeeds

sourceanswerssize todaysynced
RIR delegated statisticsis_unallocated, registry, registry_country, allocated_at262,205 IPv4, 70,920 IPv62026-10-17
Operator geofeedslocation_source, location_confidence, city468,986 IPv4, 306,905 IPv62026-10-16

Threat blocklists

sourceanswerssize todaysynced
Spamhaus DROP and ASN-DROPis_blocklisted, blocklist1,712 IPv4, 91 IPv6, 442 ASNs2026-10-17
abuse.ch Feodo Trackeris_blocklisted, blocklist1 IPv42026-10-17

Attack-source lists

sourceanswerssize todaysynced
Emerging Threats compromised hostsis_attack_source, attack_source497 IPv42026-10-17
CINS Armyis_attack_source, attack_source15,000 IPv42026-10-17
blocklist.deis_attack_source, attack_source22,922 IPv4, 517 IPv62026-10-17

Curated files

sourceanswerssize todaysynced
Satellite operatorsis_satellite, connection_type3 ASNs2026-09-12
Mobile carriersis_mobile, connection_type30 ASNs2026-09-12
Anycast resolver rangesis_anycast8 IPv4, 5 IPv62026-09-05
Compliance listssanctions, fatf_listinstalled2026-09-12

Databases

sourceanswerssize todaysynced
DB-IP Litecountry, region, city, latitude, longitude, network, asn, orginstalled2026-10-01
GeoNames placestimezone, timezone_source34,152 IPv42026-10-03

Crawlers have their own pages

The range files Googlebot, Bingbot, GPTBot and the other search and AI crawlers publish for verification are synced the same way, and each crawler has a page of its own under crawler IP ranges, with the current ranges and how to verify one.

Left out on purpose

A list is used only where its publisher's terms allow a paid product to carry its answer. These do not, or have gone quiet:

  • AbuseIPDB.Its terms of use bar selling, reselling or exploiting any portion of the API and its data, and the free plan bars commercial use; charging a credit for an answer that carries its score would be resale. An OEM data licence is the only clean route, and none has been taken.
  • abuse.ch ThreatFox and SSLBL.ThreatFox exports need an authentication key and its FAQ says commercial use may need a paid subscription; SSLBL was deprecated on 3 January 2025 and is empty.
  • SANS DShield.Its data is published under CC BY-NC-SA 4.0, which excludes commercial use.
  • Spamhaus SBL, XBL and PBL.The public mirrors are for low-volume non-commercial use; a product needs the paid Data Query Service, which has not been bought.
  • Residential-proxy data.No open source exists. Residential-proxy detection needs proprietary network telemetry; the answer does not pretend to see it.

Frequently asked questions

Where does an IP answer come from?

From data held on this server: the DB-IP Lite databases for the location and the network, the range files that clouds, VPN providers, Apple, Zscaler and the crawler operators publish themselves, the five registries’ daily statistics, the Tor Project’s exit list, the Spamhaus and abuse.ch blocklists, three attack-source lists, and a few curated files that ship with the application. Nothing is asked of a third party at lookup time, and every answer names the datasets it read in its sources block.

Why is a source a page rather than a list of addresses?

Because a source names an operator or a network, never a person, and because these pages are a reference about detection rather than a mirror. Each page says what the list is, who publishes it and on what terms, how big it is today and when it last synced, and which fields of the answer it feeds. The addresses themselves stay in the feeds.

Which lists are deliberately not used?

The ones whose terms do not allow a paid product to carry their answer, or that have gone quiet: AbuseIPDB, abuse.ch’s ThreatFox and SSLBL, SANS DShield and the Spamhaus SBL, XBL and PBL mirrors. The reasons are spelled out at the foot of this page, and residential-proxy data is not a list anyone publishes at all.

How fresh is what these pages say?

The count and the date on every page are read from the installed feed itself, not typed in. The threat and attack-source lists and the Tor feeds sync hourly, the operator files daily, the geofeeds weekly and the two databases monthly; the status page lists every dataset with its age.

counts and dates read from the installed feeds · checked 2026-10-17 · every field, documented · look up an address

Wrong result, or is it about you? If this tool said something you think is wrong, tell us and a person reads it. If Spaw is holding data about you and you never signed up here — a customer may have had your address verified, or reported that a message to it bounced — erase it yourself, confirmed by mail to that address and with no account needed.

More free tools

All free tools

Need this at scale?

The Spaw API answers with the same sources named in every response, with batch and bulk endpoints, monitored lists and your own allow and deny lists — 100 free credits a month, no card required.

Get your API key