/ip-index

A fast offline IP lookup library. Returns blacklist status, detects VPN/hosting and shows geo info.

Primary LanguageJavaScript

IP Index

An offline IP lookup database of VPN CIDRs and bad actor IP ranges. Updated daily.

Project contains:

  • An SQLite3 database containing IP ranges of datacenters, IPs used for malicious activities, ASNs and countries
  • Same plain-text files are available under /dist folder.

Why this exists

Existing solutions to detect VPNs/Proxies revolve around providing HTTP APIs or binary databases on a subscription model. Downsides of the existing projects are:

  • Extremely expensive
  • Not portable
  • Not fast enough

This database is:

  • Free
  • Portable (SQLite3)
  • Sufficiently fast

What's missing?

Some ISPs/Telecoms, while not being exactly hosting providers, might still provide mobile VPN services on specific IP addresses, which is not easy to detect. These are often covered in paid solutions.

Using black-listed IPs lists together with datacenter IP lists covers some of the bases, as those IPs are often used for malicious purposes and end up blacklisted eventually.

How are/were the datacenter ranges detected

  • The ASNs (manually) deducted from this list of Datacenters
  • The ASNs from these lists were added
  • The ASNs deducted (automatically, during build) from NordVPN's server list IPs
  • List of all ASNs names is matched against keywords that would give away datacenters or hosting

False positives are possible.

Items in database

Below is the approximate number of rows in each of the database tables. Each row contains IP or IP range in an integer notation (first and last IPs).

Table Items Info
datacenters ~127k IP ranges
blacklisted ~1.9M mostly IPs, with occasional IP ranges
asns ~1.1M ANSs with related IP ranges
countries 268k IP ranges

Sanity check

Pick some random IPs:

sort -R dist/datacenters.netset | head -n 5

Check against any of the known IP scoring services:

Usage

The project is provided with an example NodeJS library to query the database, but you are not limited to the programming language, since SQLite database is highly portable.

Run the example file:

node ./src/example.js

Output:

init: 46.245ms
Datacenter: false
Blacklisted: true
Country: de
Is EU: true
Asn: { id: 3320, name: 'Deutsche Telekom AG' }
queries: 21.886ms

Building

In case you really want to build the project yourself, you would need a NodeJS/NPM environment.

Install dependencies:

npm run deps:install

Start the build process, which would take up to a minute to complete.

TOKEN={IP2LOCATION_DOWNLOAD_TOKEN} npm run db:build

The TOKEN for the underlying ASN database could be issued with your free ip2location account.

Used projects

Acknowledgments