Enterprise-grade threat intelligence

Privacy & threat detection databases

Protect your applications from fraud, abuse, and risk with accurate and up-to-date intelligence.

Detect VPNs, proxies, abusive IPs, Tor, private relays, hosting providers, and more tied to every IP address.

iplocate-privacy-threat.csv

network	is_proxy	is_vpn	is_relay	is_tor	is_datacenter	is_crawler	is_abuser
185.220.101.48/32	true	false	false	false	true	true	false
45.61.184.0/24	false	true	false	false	true	false	false
103.234.220.190/32	true	true	false	false	true	false	true
193.218.118.0/24	false	true	false	false	true	false	false
172.224.226.34/31	false	false	true	false	true	false	false

Databases & data fields

IPLocate Privacy & threat detection database

Flags to detect proxies, VPNs, Tor, Relay services, crawlers, and addresses on abuse blocklists.

Field	Description
`network`	The IP network range (CIDR notation).
`is_proxy`	Boolean indicating if the IP address is a known anonymous or residential proxy.
`is_hosting`	Boolean indicating if the IP belongs to a hosting provider or datacenter.
`is_vpn`	Boolean indicating if the IP address is used by a known VPN provider or VPN network.
`is_tor`	Boolean indicating if the IP address is a known Tor exit node.
`is_relay`	Boolean indicating if the IP belongs to a relay service (e.g., iCloud Relay, Google One VPN).
`is_crawler`	Boolean indicating if the IP has been detected as a web crawler or scraper.
`is_abuser`	Boolean indicating if the IP is reported on an abuse blocklist.

IPLocate Hosting Providers database

Comprehensive tracking on millions of detected hosting provider and datacenter network ranges, covering more than 10,000 providers.

Field	Description
`network`	The IP address or network range (CIDR notation).
`provider`	The name of the hosting provider.
`domain`	The domain name of the hosting provider — for example: `amazonaws.com`
`region`	The region code as given by the hosting provider — for example: `us-east-1`
`service`	The name of the service this IP address/network is used for, as given by the hosting provider — for example: `EC2`

IPLocate Highres VPN & Proxy Context database Add-on

Complete data on individually observed VPN and proxy IP addresses and ranges, extracted directly from our raw data pipeline.

Field	Description
`network`	The IP address or network range (CIDR notation).
`service`	The name of the VPN or proxy service.
`service_url`	The URL of the VPN or proxy service.
`type`	The type of service and observation method. For example: `vpn_observed`, `vpn_range_inferred`, `resproxy_observed`
`last_seen`	The date and time the VPN or proxy service was last seen.
`service_region`	The region of the VPN or proxy service, if available.
`service_hostname`	The hostname of the VPN or proxy service.

Available formats

Download anonymizing IP intelligence in CSV or JSON for enrichment, MMDB for real-time lookups, or Parquet for analytics pipelines. Custom formats available on request.

CSV

Average size

300 MB - 3 GB

MMDB

Average size

450 MB - 3 GB

JSON

Average size

650 MB - 4 GB

Parquet

Average size

240 MB - 2 GB

Pricing

Privacy & Threat Detection Database

Flags to detect proxies, VPNs, Tor, Relay services, crawlers, and addresses on abuse blocklists.

$200 /month

daily updates

Hosting Providers Database

Get extended data on IP addresses associated with hosting services: provider name, domain, service type, service location, and more.

$200 /month

daily updates

Highres VPN & Proxy Context Database

Complete data on individually observed VPN and proxy IP addresses and ranges.

$22000 /year

daily updates

Why IPLocate

Privacy & threat data trusted by leading companies

We collect global threat intelligence in real-time from our measurement network of 100+ servers, identifying anonymizing infrastructure faster than anyone else.

More than 100,000 teams of all size — from solo developers to enterprise applications — trust IPLocate for fraud prevention, compliance, and security enrichment.

24/7

data pipeline runs to monitor tens of millions of individual IP addresses

10M+

anonymized IPs tracked, spanning VPNs, proxies, Tor, and residential services

5 TB

of daily telemetry powers our privacy and threat intelligence tracking

Minutes

to spot newly emerging anonymizers before they reach your applications

Purchase or get more information

To purchase a database for internal business use, fill out the form so we can verify your use case. No sales calls — we’ll send you a direct purchase link after verification.

For commercial or redistribution use, data samples, or a quote for a custom dataset, get in touch and we’ll get back to you as soon as possible.

IPLocate Privacy & Threat Detection Database (sometimes called an Anonymous IP Database) is a downloadable dataset that identifies IP addresses associated with VPNs, proxies, Tor, hosting, and other anonymizing services. Use it to block high-risk traffic, enforce compliance, and enrich fraud models.

IPLocate Hosting Providers Database catalogs millions of IP ranges operated by cloud, VPS, and datacenter providers, covering more than 10,000 organizations worldwide. It helps you recognize when traffic originates from infrastructure-as-a-service environments instead of consumer networks.

Each record lists the IP network in CIDR notation along with the provider name, primary domain, service identifier, and region codes supplied by the hosting platform. These attributes let your team map infrastructure clusters and tailor risk controls.

For example, fields such as network, provider, domain, region, and service are available to enrich your internal tooling.

You can download the Hosting Providers Database in the same formats as our other IP intelligence datasets: CSV and JSON for enrichment workflows, MMDB for latency-sensitive lookups, and Parquet for analytics pipelines. Daily updates keep the provider mappings current.

We refresh all anonymous IP databases daily as new anonymizing infrastructure appears.

Each record includes VPN, proxy, Tor, hosting, residential proxy, and risk scoring indicators along with confidence levels and source classifications.

We also offer a Highres VPN & Proxy Context Database that includes complete data on individually observed VPN and proxy IP addresses and ranges, extracted directly from our raw data pipeline.

Need custom attributes? Contact us and we can tailor the dataset.

Yes. Customers use the dataset in risk engines, SIEMs, CDPs, and analytics warehouses. Delivery formats include CSV, JSON, Parquet, and MMDB.

Yes. Our downloadable database is ideal for bulk and offline enrichment. For real-time data, you can use our IP geolocation & intelligence API with privacy and threat enrichments.

Yes. Request a sample using the form and we’ll send a preview dataset for your validation.

The dataset is licensed for internal business use. If you have a redistribution or customer-facing use case, get in touch for tailored licensing.

Yes. We track and classify residential proxy networks, mobile proxies, and hosting providers to help you spot suspicious activity.

New infrastructure is typically detected within minutes via automated monitoring and community feeds. Data downloads are refreshed daily.

Yes, all of our IP intelligence databases includes comprehensive IPv4 and IPv6 coverage, so you can protect all traffic sources.

Privacy & threat detection databases

Databases & data fields

IPLocate Privacy & threat detection database

IPLocate Hosting Providers database

IPLocate Highres VPN & Proxy Context database Add-on

Available formats