VPN providers

Italy-based community-run privacy VPN. Known for port-forwarding, SSH/SSL tunneling, and transparent exit-node listings.

Self-host VPN install script by Trail of Bits. Configures WireGuard + IKEv2 on a single cloud VM. Detection via cloud-ASN classification, not a fixed exit list.

Self-host anti-DPI VPN that configures WireGuard with amnezia-style header randomisation. Single-tenant by default; detection relies on AmneziaWG handshake signatures.

Nord Security subsidiary (wound down early 2026 and merged into NordVPN). Historic exits still resolve; detection rules recognise both product lines.

CyberGhost runs a large commercial server fleet owned by Kape Technologies. Streaming-optimised exits across 90+ countries. Protocols: WireGuard, OpenVPN, IKEv2.

Premium commercial VPN with Lightway (WireGuard-derived) and OpenVPN. Owned by Kape Technologies. Exits in 94 countries.

UK-based commercial VPN owned by Avast. 1,000+ servers across 210 countries. Streaming and bandwidth-heavy use cases.

Pango / Aura subsidiary. Uses proprietary Hydra protocol plus standard OpenVPN and IKEv2. Large free user base.

Privacy-focused provider with a small, well-maintained server fleet. Supports WireGuard by default.

P2P anti-censorship tool built on top of a commercial VPN fallback. Used heavily in Iran and China. Detection via org-keyword and known Lantern proxy ranges.

Mozilla-branded VPN service powered by Mullvad's WireGuard relay infrastructure. Exits overlap with the Mullvad relay list.

Mullvad is a privacy-focused Swedish provider with a strict no-logs policy, cash-and-XMR payment accepted, and a public WireGuard relay list. IPLogs refreshes the Mullvad relay list every 6 hours for highest-confidence detection.

Decentralised P2P VPN marketplace. Exit nodes are volunteer-run residential IPs; detection overlaps with residential-proxy signals.

NordVPN operates one of the largest commercial VPN server fleets worldwide. Exits are typically registered under AS212238 or rented in partner datacenters in 60+ countries. Protocols include OpenVPN TCP/UDP, IKEv2/IPsec, and NordLynx (WireGuard).

Mixnet-based privacy VPN layered on the Nym network. Separates metadata from content across multiple relays. Detection relies on the Nym public relay list.

Browser-embedded VPN shipped with Opera and Opera GX. Exits via SurfEasy-operated hardware. Limited to browser traffic.

Google Jigsaw's self-host VPN stack based on Shadowsocks. Not a commercial exit network; detection relies on Shadowsocks / cipher fingerprints rather than a fixed IP list.

Swiss commercial VPN with a free tier. Own-infrastructure claim; detection via ASN and hostname patterns.

Long-running US-based VPN. Owned by Kape Technologies. Large IP pool with consistent WireGuard support.

Switzerland-based VPN by the Proton Mail team. Supports OpenVPN, WireGuard, and Stealth (Proton's obfuscation protocol). Free tier available.

Commercial VPN with broad country coverage. Detected primarily via ASN rentals at major datacenters and reverse-DNS patterns.

Open-source multi-protocol VPN server from the University of Tsukuba (Japan). Widely used by volunteer exit operators. Detection relies on SoftEther signatures in the ClientHello and the vpngate.net relay list.

Self-host VPN install script that provisions multiple circumvention protocols (Shadowsocks, OpenVPN, Tor bridges, WireGuard) on a single cloud VM.

Commercial VPN with unlimited device coverage. Acquired by NordVPN parent Nord Security in 2022.

Long-running US commercial VPN. Bundled proxy service. Detection via ASN rentals and reverse-DNS.

Consumer VPN with playful branding. Owned by McAfee. Limited free tier.

Academic / volunteer VPN run on top of SoftEther. Exit list is public and refreshed from vpngate.net. Used heavily for censorship circumvention.

Swiss-registered commercial VPN best known for its Chameleon obfuscation protocol. Historically operated its own exit hardware; now hybrid with partner datacenters.

Canadian VPN with a generous free tier and obfuscation feature (Stealth) on top of OpenVPN.

Windscribe's restricted free tier (10 GB/month). Different exit pool from the paid product; detection uses the same `vpn_org_keyword` rule.

Generic single-tenant WireGuard deployment on a rented VM. Detected via `active_probe_wireguard` plus cloud-ASN classification rather than a fixed exit list.