The free data feeds behind a serious IP check (and how to combine them)

Cloud provider ranges, Spamhaus DROP, PeeringDB and the Tor exit list: what each one gives you, where it fails, and how to combine them without buying a commercial database.

Why free feeds are enough for most checks

Commercial IP data is expensive and often opaque. Four public feeds cover most of what a store-safety check needs:

1. Cloud provider ranges — AWS, GCP, Azure and Cloudflare publish their address space.
2. Spamhaus DROP — hijacked and criminal ranges, updated daily.
3. PeeringDB — every network's self-declared type: Cable/DSL/ISP, NSP, Content, Enterprise…
4. Tor exit list — the one feed that is exact by construction.

1. Cloud ranges

AWS publishes ip-ranges.json, GCP cloud.json, Cloudflare ips-v4. Parse them into CIDR sets and you can answer "is this address rented cloud capacity?" without knowing the ASN at all.

Why it matters: brand tables (Vultr, Hetzner…) cover the obvious providers, but resellers and smaller clouds hide behind generic names. A range match does not care about the name.

{ "aws": ["3.5.140.0/22", "…"], "gcp": ["34.117.0.0/16", "…"] }

2. Spamhaus DROP

DROP lists ranges that Spamhaus considers hijacked or criminal. It is not a residential-proxy signal, but it is a real risk signal that most cheap tools miss — and it is free.

Two caveats: it changes daily (cache with a timestamp), and it is aggressive. Treat a hit as "raise the score", not "block the user".

3. PeeringDB

PeeringDB is a self-declared registry. Its info_type is the useful part:

| info_type | What it usually means |

|---|---|

| Cable/DSL/ISP | consumer ISP — the closest thing to "residential" |

| NSP | transit provider — announces other people's traffic |

| Content | a content network (often CDN or self-hosted edge) |

| Enterprise | a company network, not a household |

| Educational/Research | universities and research networks |

Self-declared means a small ISP may be missing. Use it to refine a verdict, never to overrule a stronger signal.

4. Tor exit list

The Tor Project publishes the bulk exit list. Match exact IPs only — Tor exits are individual addresses, not blocks. Refresh every few hours; exits rotate.

Putting them together

Order matters:

Tor hit            → Tor
cloud range hit    → datacenter
DROP hit           → risk score +, blacklist flag
PeeringDB Cable/DSL → ISP, unless a stronger signal fired

A pipeline like this gets you most of the way to a commercial feed without the license cost. What you give up: residential-proxy identification (needs commercial data or live behavioural signals), and BGP history.

We publish the audit for our own mix at any time on /methodology, including which reference set each check used.