IP to Hosting Database

The IP to Hosting Database is a database in CSV or MMDB format that contains all known hosting / cloud IP ranges of the Internet. The database is continuously updated and new hosting / cloud IP ranges are added as soon as they emerge. The database considers IP ranges from all of the following service types as hosting IP ranges:

• Normal hosting providers such as Hetzner.de or Leaseweb.com
• Large cloud providers such as Amazon AWS or Microsoft Azure
• Content Delivery Networks such as Cloudflare, Fastly or edg.io
• Anti-DDOS services such as qrator.net or ddos-guard.net
• IP leasing organizations such as ipxo.com or interlir.com
• Other SaaS, IaaS, or PaaS organizations such as fly.io or Heroku

For many IT security applications, it is essential to know whether an IP address belongs to a hosting provider. A substantial part of the malicious traffic in the Internet originates from hosting IP ranges. Examples of malicious traffic that you want to block is: Scanning activity, scraping, crawling, traffic from VPN or Proxy servers, automated attack traffic and so on.

{
  "is_datacenter": true,
  "datacenter": {
    "datacenter": "Amazon AWS",
    "network": "3.5.140.0/22",
    "region": "ap-northeast-2",
    "service": "AMAZON",
    "network_border_group": "ap-northeast-2"
  }
}

# Purchase Database

To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file for all formats.

# Hosting Database Format

The file format of the IP to Hosting Database is in CSV or MMDB format and contains the following fields:

• ip_version - Either 4 (IPv4) or 6 (IPv6), determining the IP type of the network.
• startIp - The start IP address of the range in string format. Example: 45.59.132.0
• endIp - The end IP address of the range in string format. Example: 45.59.135.255
• datacenter - The name of the hosting / cloud provider. Example: PureVoltage Hosting Inc.
• domain - The domain name of the hosting / cloud provider. Example: purevoltage.com

The following CSV example contains an small excerpt of the entire database:

startIp,endIp,ipVersion,datacenter,domain
92.222.187.0,92.222.187.255,4,OVH VPS ES,ovh.net
153.120.81.0,153.120.81.255,4,SAKURA Internet Inc.,sakura.ad.jp
185.39.138.85,185.39.138.85,4,MissDomain Group AB,missdomain.com
86.66.23.232,86.66.23.239,4,Internet Services,isi.ch
51.77.100.128,51.77.100.143,4,OVH Ltd,ovh.co.uk
38.142.65.248,38.142.65.255,4,"Imperva, Inc",www.imperva.com
185.103.97.252,185.103.97.255,4,UK Dedicated Servers Ltd,uksrv.co.uk
103.64.80.0,103.64.83.255,4,"Guangdong Aofei Data Technology Co., Ltd.",ofidc.com
194.218.29.104,194.218.29.111,4,Iver Sverige AB,iver.com
135.125.25.152,135.125.25.159,4,OVH SAS,ovhcloud.com
46.165.192.0,46.165.255.255,4,Leaseweb Deutschland GmbH,leaseweb.com
5.198.151.0,5.198.151.127,4,Xidras GmbH,xidras.com
78.41.202.254,78.41.202.254,4,Snel.com B.V.,snel.com
217.57.169.16,217.57.169.23,4,ASAS.R.L.,lir.ae
94.46.126.31,94.46.126.31,4,MissDomain Group AB,missdomain.com
133.32.45.0,133.32.45.255,4,"GMO Internet,Inc.",gmo.jp
5.9.232.240,5.9.232.255,4,Hetzner Online GmbH,hetzner.com
176.9.127.64,176.9.127.95,4,Hetzner Online GmbH,hetzner.com
94.130.41.176,94.130.41.183,4,Hetzner Online GmbH,hetzner.com
159.148.115.56,159.148.115.63,4,SIA Latnet,bite.lv
51.91.67.0,51.91.67.255,4,OVH SAS,ovhcloud.com
89.151.66.192,89.151.66.255,4,Pulsant Limited,pulsant.com
156.240.103.0,156.240.103.255,4,Bunny Technology LLC,bunny.net
149.6.42.4,149.6.42.7,4,Netwise Hosting Ltd,netwise.co.uk

# How to use the IP to Hosting Database?

This example shows how to work with the IP to Hosting Database in MMDB format.

curl -O https://ipapi.is/data/samples/HostingRangesIPv4-Sample.mmdb

And parse with mmdbctl:

mmdbctl read -f json-pretty 2.27.121.0 HostingRangesIPv4-Sample.mmdb

which outputs:

{
  "datacenter": "NEKOBYTE INTERNATIONAL LIMITED",
  "domain": "it-garage.pro",
  "ip": "2.27.121.0",
  "ipVersion": "4",
  "network": "2.27.121.0-2.27.121.255"
}

# What is Hosting Detection?

Ipapi.is strongly emphasizes Hosting Detection. Hosting detection is the process of determining whether an IP address belongs to a hosting provider. Knowing whether an IP address is associated with a hosting or cloud provider carries significant IT security implications, since a lot of malicious traffic in the Internet originates from hosting IP ranges. A sophisticated hosting detection algorithm was developed to identify thousands of new and lesser-known hosting providers across the entire Internet.

Information on whether an IP address belongs to a hosting provider is displayed directly in the API output in the is_datacenter field. For example, the following IP addresses are all associated with hosting or cloud providers:

• 94.130.228.239 - Hetzner Online GmbH
• 156.224.19.121 - Arosscloud INC
• 149.88.110.171 - Datacamp Limited
• 217.182.121.212 - Raiola Networks SL
• 45.79.150.128 - Linode

Click on the button below in order to view all currently tracked hosting providers:

# How does Hosting Detection Work?

Each IP address in the Internet is owned or administered by an organization or institute. This organization can be privately owned or part of a nonprofit organization. Regional Internet Registries (RIRs) such as ARIN, RIPE NCC, or APNIC store this information in WHOIS databases.

Therefore, it is possible to map each IP address on the Internet to its administrative organization. The next step is to determine whether this organization is a hosting provider or not. This step is particularly challenging since WHOIS information does not directly include this detail. Often, WHOIS records only contain the bare minimum of information about organizations for privacy reasons.

Most WHOIS databases store IP ranges in NetRange or inetnum objects. These objects are usually linked to an organization name. Based on this linked organization name, a hosting provider classification must be made. Any other approach leads to the problem that the corresponding IP ranges are hard to identify. Put differently: The organization name from WHOIS records can only be extracted in such a way that a direct correlation to the IP range remains intact. Otherwise, IP ranges couldn't be classified.

Several different strategies are pursued in order to determine if an organization is a hosting provider or not:

• The least efficient method is to manually label organizations as hosting providers. This is practically impossible, since the Internet is constantly evolving and manually labeling hundreds of thousands of organizations is not an efficient process.
• A more efficient method is to automatically label organizations as hosting providers based on metadata such as organization name, organization domain, organization website with HTML text and HTML meta tags as input. For this purpose, ipapi.is constantly monitors websites of all major network-owning organizations of the Internet. This requires crawling hundreds of thousands of websites on a monthly basis. The hosting detection algorithm is described in a dedicated blog article.
• Many large hosting providers publish their IP ranges on their website. Hundreds of such feeds are used. Examples:
  • Google Cloud IP Ranges
  • Azure IP Ranges
  • Amazon AWS IP Ranges
  • DigitalOcean IP Ranges
  • Linode IP Ranges
• Another approach is to consider the work of open-source projects that attempt to find hosting IP addresses. Examples of such projects are:
  • github.com/client9/ipcat
  • github.com/Umkus/ip-index
  • github.com/X4BNet/lists_vpn

By employing the above strategies, thousands of hosting providers and their IP networks are tracked. This data collection and data labeling process is time-consuming and is prone to false positives. ipapi.is focuses on false positive reduction and provides the most comprehensive hosting provider database on the Internet.

# Why is Hosting Detection important?

Often, hosting providers allow their clients to purchase computing and networking resources without providing any form of identification. Those resources are often abused for the following malicious purposes:

• Hosting VPN and proxy servers
• Scanning and crawling software
• Malware and viruses
• Bots and Crawlers
• VNC or Remote Desktop Servers

Hosting providers can give cybercriminals the necessary infrastructure to launch attacks on the Internet. Knowing whether an IP address belongs to a hosting provider is therefore essential for security purposes. As a general rule of thumb, there is no good reason to allow traffic on your website or app to originate from hosting IP ranges, since normal end users browse the Internet from their home or office IP (ISP and Business IP ranges).

# IP to Hosting Package (npm)

The ip-to-hosting npm package gives you an accurate tool to determine if an IP address belongs to a hosting provider or not.

# List of Hosting Providers

The table below lists the top 2000 hosting providers of the Internet.