What VPNDB answers

VPNDB answers one question. For an IP address, a prefix or an autonomous system: which VPN or proxy provider operates behind it, with what probability, and on what evidence.

The evidence clause is the operative one. Comparable services report that an address is anonymised. VPNDB reports whose infrastructure it is, the confidence in that attribution, and the basis for it, so the answer can be assessed against the decision it will support.

What makes it different

• Provider distribution per network. For an ASN or prefix, the share of observed addresses per provider. AS136787 resolves to NordVPN at 99.9 %; AS9009 carries 25 providers, led by CyberGhost at 41.6 %.
• Method recorded on every claim. probe, scan, cert, feed.
• Certificate attribution. VPN operators run their own certificate authority and identify themselves in the issuer field.
• Virtual locations. Advertised server location against observed egress location.
• Time series. 8.0 million observations since November 2024, supporting point-in-time, churn and trend analysis rather than a current snapshot alone.

What it deliberately does not do

Client behaviour, device type, concentration and spread require traffic telemetry that is not collected and is not planned. These fields are omitted rather than estimated.