VPN providers

Italy-based community-run privacy VPN. Known for port-forwarding, SSH/SSL tunneling, and transparent exit-node listings. ~255 servers across 24 countries with both IPv4 and IPv6 endpoints (1,000+ IPs each). Iplogs.com ingests airvpn.org/api/status every 12 hours — every active AirVPN exit IP across all four interface slots is matched via the high-precision vpn_relay_list signal.

Self-host VPN install script by Trail of Bits. Configures WireGuard + IKEv2 on a single cloud VM. Detection via cloud-ASN classification, not a fixed exit list.

Self-host anti-DPI VPN that configures WireGuard with amnezia-style header randomisation. Single-tenant by default; detection relies on AmneziaWG handshake signatures.

Nord Security subsidiary (wound down early 2026 and merged into NordVPN). Historic exits still resolve; detection rules recognise both product lines.

Swedish privacy-first VPN with a public unauthenticated locations API. ~62 server pools across Europe, North America, and Asia-Pacific. Iplogs.com queries api.azirevpn.com/v2/locations every 12 hours and DNS-resolves each pool — every active AzireVPN exit IP is flagged via the vpn_relay_list signal.

CyberGhost runs one of the largest commercial server fleets globally — ~10,000 servers across 90+ countries. Owned by Kape Technologies. Streaming-optimised exits. CyberGhost's server-list endpoints are auth-walled, so iplogs.com matches CyberGhost exits via the X4BNet aggregator (community-maintained, daily-refreshed, covers CyberGhost + every other major commercial VPN).

Premium commercial VPN with Lightway (WireGuard-derived) and OpenVPN. Owned by Kape Technologies. ~3,000 servers across 94 countries. ExpressVPN's server-list endpoint requires authentication, so iplogs.com matches ExpressVPN exits via the X4BNet aggregator (community-maintained, daily-refreshed) plus active OpenVPN/Lightway probes.

UK-based commercial VPN owned by Avast. 1,000+ servers across 210 countries. Streaming and bandwidth-heavy use cases.

Pango / Aura subsidiary. Uses proprietary Hydra protocol plus standard OpenVPN and IKEv2. Large free user base.

Long-running US commercial VPN (J2 Global / Ziff Davis subsidiary) with ~370 servers across 75+ countries. Iplogs.com ingests every published .ovpn config from configs.ipvanish.com and DNS-resolves each remote hostname every 12 hours — every IPVanish exit IP is matched via the high-precision vpn_relay_list signal.

Privacy-focused provider with a small, well-maintained server fleet (~58 WireGuard gateways across 30+ countries). Iplogs.com ingests their full server list directly from api.ivpn.net/v5/servers.json every 12 hours, so every IVPN exit IP is detected via the high-confidence vpn_relay_list signal — no honeypot inference needed.

P2P anti-censorship tool built on top of a commercial VPN fallback. Used heavily in Iran and China. Detection via org-keyword and known Lantern proxy ranges.

Mozilla-branded VPN service powered by Mullvad's WireGuard relay infrastructure. Exits overlap with the Mullvad relay list.

Mullvad is a privacy-focused Swedish provider with a strict no-logs policy, cash-and-XMR payment accepted, and a public WireGuard relay list. IPLogs ingests the full Mullvad relay catalogue directly from api.mullvad.net every 6 hours — every active relay IP (WireGuard, OpenVPN, and Shadowsocks bridges) is matched via the high-precision vpn_relay_list signal. Cross-validated against the X4BNet aggregator.

Decentralised P2P VPN marketplace. Exit nodes are volunteer-run residential IPs; detection overlaps with residential-proxy signals.

NordVPN operates one of the largest commercial VPN server fleets worldwide (~7,000 servers across 60+ countries). Exits are typically registered under AS212238 (Datacamp / M247) or rented in partner datacenters. Protocols include OpenVPN TCP/UDP, IKEv2/IPsec, and NordLynx (WireGuard). NordVPN's own server-list API has been deprecated, so iplogs.com matches NordVPN exits via the X4BNet aggregator (10,667 CIDRs covering NordVPN + every other major commercial VPN, daily-refreshed) plus active OpenVPN/WireGuard probes for live confirmation.

Mixnet-based privacy VPN layered on the Nym network. Separates metadata from content across multiple relays. Detection relies on the Nym public relay list.

Browser-embedded VPN shipped with Opera and Opera GX. Exits via SurfEasy-operated hardware. Limited to browser traffic.

Google Jigsaw's self-host VPN stack based on Shadowsocks. Not a commercial exit network; detection relies on Shadowsocks / cipher fingerprints rather than a fixed IP list.

Swiss commercial VPN with a free tier. Own-infrastructure claim; detection via ASN and hostname patterns.

Long-running US-based VPN. Owned by Kape Technologies. ~3,300 servers across 80+ countries. Iplogs.com ingests the full PIA server catalogue directly from serverlist.piaservers.net every 12 hours — every PIA exit IP across WireGuard, OpenVPN, IKEv2, and Shadowsocks is matched via the high-precision vpn_relay_list signal.

Switzerland-based VPN by the Proton Mail team. Supports OpenVPN, WireGuard, and Stealth (Proton's obfuscation protocol). Free tier available. ProtonVPN's own server-list API is now auth-walled, so iplogs.com matches ProtonVPN exits via the X4BNet aggregator (community-maintained, daily-refreshed, 10,667 CIDRs covering Proton + every other major commercial VPN).

Commercial VPN with broad country coverage. Detected primarily via ASN rentals at major datacenters and reverse-DNS patterns.

Open-source multi-protocol VPN server from the University of Tsukuba (Japan). Widely used by volunteer exit operators. Detection relies on SoftEther signatures in the ClientHello and the vpngate.net relay list.

Self-host VPN install script that provisions multiple circumvention protocols (Shadowsocks, OpenVPN, Tor bridges, WireGuard) on a single cloud VM.

Commercial VPN with unlimited device coverage. Acquired by NordVPN parent Nord Security in 2022. ~3,200 servers across 100+ countries. Iplogs.com queries api.surfshark.com/v4/server/clusters every 12 hours and DNS-resolves every cluster hostname — every active Surfshark exit IP is matched via the vpn_relay_list signal.

Long-running US commercial VPN. Bundled proxy service. Detection via ASN rentals and reverse-DNS.

Consumer VPN with playful branding. Owned by McAfee. Limited free tier.

Academic / volunteer VPN run on top of SoftEther. Exit list is public and refreshed from vpngate.net. Used heavily for censorship circumvention.

Swiss-registered commercial VPN best known for its Chameleon obfuscation protocol. Historically operated its own exit hardware; now hybrid with partner datacenters.

Canadian VPN with a generous free tier and obfuscation feature (Stealth) on top of OpenVPN.

Windscribe's restricted free tier (10 GB/month). Different exit pool from the paid product; detection uses the same `vpn_org_keyword` rule.

Generic single-tenant WireGuard deployment on a rented VM. Detected via `active_probe_wireguard` plus cloud-ASN classification rather than a fixed exit list.