Skip to content
Spaw
Get your API key

The data behind an IP answer

Every IP answer names the datasets it read. This is the list of them: the clouds, VPN providers, relay and gateway operators whose own range files are synced, the Tor Project's exits, the registries, the threat and attack-source lists, the curated files and the two databases — each with its publisher, its terms, its size today and the fields of the answer it feeds. A source names a network or an operator, never a person.

Clouds and hosting

sourceanswerssize todaysynced
Amazon Web Servicesis_datacenter, hosting_provider, connection_type9,259 IPv4, 3,626 IPv62026-09-12
Google Cloudis_datacenter, hosting_provider, connection_type1,008 IPv4, 95 IPv62026-09-12
Microsoft Azureis_datacenter, hosting_provider, connection_type912 IPv4, 1,294 IPv62026-09-12
Oracle Cloudis_datacenter, hosting_provider, connection_type1,107 IPv42026-09-12
DigitalOceanis_datacenter, hosting_provider, location_source, city1,086 IPv4, 148 IPv62026-09-12
Linodeis_datacenter, hosting_provider, location_source, city5,409 IPv4, 96 IPv62026-09-12
Vultris_datacenter, hosting_provider, location_source, city445 IPv4, 57 IPv62026-09-12
Cloudflareis_datacenter, hosting_provider, is_anycast15 IPv4, 7 IPv62026-09-12
Fastlyis_datacenter, hosting_provider, is_anycast19 IPv4, 2 IPv62026-09-12
GitHub Actionsis_datacenter, hosting_provider, connection_type5,436 IPv4, 1,544 IPv62026-09-12

VPN and relay

sourceanswerssize todaysynced
Mullvadis_vpn, privacy_service, is_anonymous, location_source563 IPv4, 553 IPv62026-09-12
NordVPNis_vpn, privacy_service, is_anonymous, location_source8,043 IPv4, 1 IPv62026-09-12
Private Internet Accessis_vpn, privacy_service, is_anonymous, location_source1,386 IPv42026-09-12
IVPNis_vpn, privacy_service, is_anonymous, location_source176 IPv42026-09-12
AirVPNis_vpn, privacy_service, is_anonymous, location_source1,028 IPv4, 1,028 IPv62026-09-12
VPN Gateis_vpn, privacy_service, is_anonymous, location_source100 IPv42026-09-12
iCloud Private Relayis_relay, privacy_service, is_anonymous, location_source41,981 IPv4, 245,860 IPv62026-09-12
Cloudflare WARPinferredis_vpn, privacy_service, is_anonymous1 ASNs2026-09-12

Corporate gateways

sourceanswerssize todaysynced
Zscaleris_corporate_proxy, corporate_proxy, connection_type2,310 IPv4, 453 IPv62026-09-12

Tor

sourceanswerssize todaysynced
Tor exit listis_tor, tor_last_seen, is_anonymous3,976 IPv4, 1,871 IPv62026-09-13

Aggregate lists

sourceanswerssize todaysynced
X4BNet datacenter and VPN listsis_datacenter, is_vpn53,857 IPv4, 9,250 IPv62026-09-12

Registries and geofeeds

sourceanswerssize todaysynced
RIR delegated statisticsis_unallocated, registry, registry_country, allocated_at261,179 IPv4, 70,569 IPv62026-09-12
Operator geofeedslocation_source, location_confidence, city468,189 IPv4, 217,469 IPv62026-09-08

Threat blocklists

sourceanswerssize todaysynced
Spamhaus DROP and ASN-DROPis_blocklisted, blocklist1,745 IPv4, 92 IPv6, 434 ASNs2026-09-12
abuse.ch Feodo Trackeris_blocklisted, blocklist1 IPv42026-09-13

Attack-source lists

sourceanswerssize todaysynced
Emerging Threats compromised hostsis_attack_source, attack_source610 IPv42026-09-13
CINS Armyis_attack_source, attack_source15,000 IPv42026-09-13
blocklist.deis_attack_source, attack_source27,918 IPv4, 394 IPv62026-09-13

Curated files

sourceanswerssize todaysynced
Satellite operatorsis_satellite, connection_type3 ASNs2026-09-12
Mobile carriersis_mobile, connection_type30 ASNs2026-09-12
Anycast resolver rangesis_anycast8 IPv4, 5 IPv62026-09-05
Compliance listssanctions, fatf_listinstalled2026-09-12

Databases

sourceanswerssize todaysynced
DB-IP Litecountry, region, city, latitude, longitude, network, asn, orginstalled2026-09-01
GeoNames placestimezone, timezone_source34,136 IPv42026-09-12

Crawlers have their own pages

The range files Googlebot, Bingbot, GPTBot and the other search and AI crawlers publish for verification are synced the same way, and each crawler has a page of its own under crawler IP ranges, with the current ranges and how to verify one.

Left out on purpose

A list is used only where its publisher's terms allow a paid product to carry its answer. These do not, or have gone quiet:

  • AbuseIPDB.Its terms of use bar selling, reselling or exploiting any portion of the API and its data, and the free plan bars commercial use; charging a credit for an answer that carries its score would be resale. An OEM data licence is the only clean route, and none has been taken.
  • abuse.ch ThreatFox and SSLBL.ThreatFox exports need an authentication key and its FAQ says commercial use may need a paid subscription; SSLBL was deprecated on 3 January 2025 and is empty.
  • SANS DShield.Its data is published under CC BY-NC-SA 4.0, which excludes commercial use.
  • Spamhaus SBL, XBL and PBL.The public mirrors are for low-volume non-commercial use; a product needs the paid Data Query Service, which has not been bought.
  • Residential-proxy data.No open source exists. Residential-proxy detection needs proprietary network telemetry; the answer does not pretend to see it.

Frequently asked questions

Where does an IP answer come from?

From data held on this server: the DB-IP Lite databases for the location and the network, the range files that clouds, VPN providers, Apple, Zscaler and the crawler operators publish themselves, the five registries’ daily statistics, the Tor Project’s exit list, the Spamhaus and abuse.ch blocklists, three attack-source lists, and a few curated files that ship with the application. Nothing is asked of a third party at lookup time, and every answer names the datasets it read in its sources block.

Why is a source a page rather than a list of addresses?

Because a source names an operator or a network, never a person, and because these pages are a reference about detection rather than a mirror. Each page says what the list is, who publishes it and on what terms, how big it is today and when it last synced, and which fields of the answer it feeds. The addresses themselves stay in the feeds.

Which lists are deliberately not used?

The ones whose terms do not allow a paid product to carry their answer, or that have gone quiet: AbuseIPDB, abuse.ch’s ThreatFox and SSLBL, SANS DShield and the Spamhaus SBL, XBL and PBL mirrors. The reasons are spelled out at the foot of this page, and residential-proxy data is not a list anyone publishes at all.

How fresh is what these pages say?

The count and the date on every page are read from the installed feed itself, not typed in. The threat and attack-source lists and the Tor feeds sync hourly, the operator files daily, the geofeeds weekly and the two databases monthly; the status page lists every dataset with its age.

counts and dates read from the installed feeds · checked 2026-09-13 · every field, documented · look up an address

Wrong result, or is it about you? If this tool said something you think is wrong, tell us and a person reads it. If Spaw is holding data about you and you never signed up here — a customer may have had your address verified, or reported that a message to it bounced — erase it yourself, confirmed by mail to that address and with no account needed.

More free tools

All free tools

Need this at scale?

The Spaw API answers with the same sources named in every response, with batch and bulk endpoints, monitored lists and your own allow and deny lists — 10 free lookups a month, no card required.

Get your API key