Evidence
External sources
Thirteen published lists, retrieved and read locally, each with its licence recorded.
Some attributes cannot be measured here. There is no probing channel for Tor or for iCloud Private Relay. Published lists supply these and several others.
| Source | Supplies | Licence |
|---|---|---|
| Tor Bulk Exit List | types: ["TOR"], the sole source for it | CC0 |
| iCloud Private Relay | types: ["RELAY"], with the city each egress presents as | published, no grant |
| Open-Source VPN IP Lists | Per-provider lists for nine VPNs; cross-checks attribution | CC0 |
| X4B VPN / Datacenter | Independent corroboration and DATACENTER classification | MIT |
| Spamhaus DROP / ASN-DROP | Abuse context for a network | free, attribution required |
| PeeringDB | Network type per ASN: carrier against access ISP | own mirror only |
| AWS, GCP, Oracle, DigitalOcean, Cloudflare | DATACENTER classification | published, no grant |
Nothing is queried live
Each list is downloaded on a schedule and read from disk. No request leaves the host during a lookup. This is what makes an air-gapped installation viable: behaviour is identical to a connected one, with an older retrieval date.
Agreement and disagreement
Lists that name the provider, rather than flagging “a VPN”, can be compared against our own attribution. Agreement constitutes independent corroboration. Disagreement indicates either a coverage gap here or an error there. Both are reported; neither is recoverable if the data is reduced to a binary flag.
Source catalogueEach source with licence, record count and retrieval age.Open →