We Just Released 9 Free IP Intelligence Datasets (CSV, JSON, Auto-Refreshed)

Every time we've written about VPN detection, fraud prevention, or proxy classification, the same question lands in our inbox: where do I get the data?Engineers building bot defences want a current Tor exit list. Fraud teams want a stable list of commercial VPN ASNs. Compliance teams want a machine-readable country catalogue. Today we're releasing all of it, free and auto-refreshed, at iplogs.com/tools.

Nine datasets, CSV / JSON / TXT, CC-BY 4.0, refreshed between hourly and daily depending on upstream cadence. No signup, no API key, no rate limit beyond normal fair use. Stable URLs you can point a cron job or build script at.

What's in the release

• Tor exit nodes — /data/tor-exits.csv. ~3,800 rows. Refreshed hourly from the Tor Project's official exit-addresses feed, with columns for ip, published, last_status, seen_at.
• Commercial VPN ASNs — /data/vpn-asns.csv. Every autonomous system officially registered to a commercial VPN provider. Any IP inside one of these ASNs is a confirmed VPN exit without needing a probe.
• Datacenter and CDN ASNs — /data/datacenter-asns.csv. Curated catalogue spanning hyperscalers (AWS, GCP, Azure), budget hosts (Hetzner, OVH, Vultr), residential-proxy backbones, and CDN edges.
• Residential-proxy backbone ASNs — /data/residential-proxy-backbones.csv. 26 hosting networks that historically host residential-proxy infrastructure (Leaseweb, ColoCrossing, M247, Performive, Hivelocity, HostPapa). Matches the residential_proxy_backbone signal used in our detection pipeline.
• Mullvad WireGuard relays — /data/mullvad-relays.csv. Every active Mullvad exit with hostname, country, city, IPv4, IPv6, provider, type, ownership flag. Refreshed every 6 hours from api.mullvad.net.
• VPN provider catalogue — /data/vpn-providers.csv. 31 commercial and self-host VPN providers with jurisdiction, registered ASN, protocols, and the signals that flag them in the 7-layer detection pipeline.
• Country IP context — /data/countries.csv. 73 countries with dominant residential ISPs, hosting footprint, and known VPN provider presence. Useful for geo-risk scoring and regional compliance.
• Cloudflare IP ranges — /data/cloudflare-ranges.txt. IPv4 + IPv6 CIDRs mirrored with a stable Cache-Controlso build scripts don't need to hammer Cloudflare directly.
• AWS IP ranges — /data/aws-ranges.json. Amazon's full ip-ranges.json mirrored with our own cache policy.

Why we built it

The IP-intelligence space has a weird asymmetry: the data underlying every commercial classifier is mostly public or well-known, but it's scattered across a dozen upstream endpoints, licences, and rate-limit regimes. Anyone integrating a fraud check, bot defence, or research tool ends up wiring together the same half-dozen feeds. We were already maintaining the plumbing internally to power the IPLogs live checker. Publishing it as raw data takes essentially no additional effort, and it saves every downstream team the plumbing.

The secondary reason is honesty in the market. Commercial IP-intel vendors charge per-lookup prices that assume you can't see the underlying data. That's true for a small number of proprietary signals (some residential-proxy catalogues, fingerprint libraries). It's nottrue for Tor exits, published ASN registries, Mullvad's own relay list, or AWS/Cloudflare's own published ranges. Putting these in one place makes the pricing conversation clearer.

How to use them

curl

curl -s https://iplogs.com/data/tor-exits.csv | wc -l
# 3817

curl -s https://iplogs.com/data/vpn-asns.csv
# asn,name,country,description
# AS212238,NordVPN,PA,...
# AS397397,Mullvad VPN AB,SE,...
# AS55286,Private Internet Access,US,...
# AS209103,Proton AG,CH,...
# AS36599,SoftEther Project,JP,...

Python

import csv, urllib.request

with urllib.request.urlopen("https://iplogs.com/data/tor-exits.csv") as r:
    reader = csv.DictReader(r.read().decode().splitlines())
    tor_ips = {row["ip"] for row in reader}

def is_tor_exit(ip: str) -> bool:
    return ip in tor_ips

Go

resp, _ := http.Get("https://iplogs.com/data/datacenter-asns.csv")
defer resp.Body.Close()
reader := csv.NewReader(resp.Body)
reader.Read() // skip header
for {
    row, err := reader.Read()
    if err == io.EOF { break }
    // row[0] = ASN, row[1] = name, row[2] = country, row[3] = category
}

Licence

The datasets we produce ourselves (catalogue, country context, provider list, residential-proxy backbones) are released under Creative Commons BY 4.0. You may use, redistribute, and modify them commercially provided you cite IPLogs. Upstream sources (Tor Project, Mullvad, Cloudflare, AWS) retain their own licences — we simply provide a convenient mirror with a stable URL and normalised schema.

Suggested citation: IPLogs (2026). {Dataset name}. https://iplogs.com/tools

Refresh cadence

Each dataset is refreshed at the fastest rate the upstream source updates:

• Tor exits — hourly
• Mullvad relays — every 6 hours
• Everything else — daily

HTTP Cache-Control is set to public, max-age=1800, stale-while-revalidate=3600. That's 30 minutes of hard browser cache plus a 1-hour stale window while the next regeneration runs. If you're pulling from a build script, treat the files as effectively cached for an hour.

What's coming next

• ExpressVPN, NordVPN, Surfshark relay lists — currently we mirror Mullvad because they publish a proper API. Other providers will land when we finish the scraping plumbing.
• Public proxy aggregate — the 1.9M-IP feed used internally by the public_proxy_list detection signal. Held back for now because of size; may ship as a sharded set.
• Dataset-level IndexNow — push new Tor exits to Bing and Yandex within minutes of detection.
• Historical snapshots — weekly diffs of ASN and country catalogues so researchers can track infrastructure turnover.

If there's a dataset you need that we haven't covered, email admin@iplogs.com— if we can source it legally and maintain it without per-user state, we'll ship it.

Try it now

Browse the datasets →

Or if you'd rather hit the live API: iplogs.com/docs. Same classifications, real-time, one-IP-at-a-time.