Why VPN blacklisting

Apility.io’s philosophy has always been to be an aggregator of the best open-source intelligence data (OSINT). Over time we have discovered that open data sets cover a large percentage of users’ needs, but not all of them. For VPN blacklisting the available datasets are not enough, are not up to date, or simply do not exist.

We have searched among the paid sources of information to fill the gaps and offer a better service. However, the quality of the paid sources is sometimes not good enough. Or the agreement for their redistribution is incompatible with our sales model.

One of the most popular datasets that can be purchased are the IP addresses of non-logging VPN providers. By examining the accuracy and freshness of these data, we have discovered that the information available is either not up to date or not complete. That’s why we decided to build our own databases of outbound IP addresses.

VPN blacklisting: custom-built datasets

We have implemented scraping services that constantly build all the data sets. These processes keep the IP address list of the most popular VPNs fresh and accurate. This ensures that combining these datasets with other open lists provides the best possible protection. At this time, these datasets are new, so don’t hesitate to give us feedback for continuous improvement.

Nordvpn and Expressvpn datasets

NordVPN and ExpressVPN are two of the most popular no-logging VPN service with hundreds of servers each deployed worldwide. They can be used to mask the identities of abusers because they don’t store any logging information about the activity of the users. There are two blacklists sets:

  • A low criticality set with the IP addresses of the hosts where the users connect to access the NordVPN and ExpressVPN services. You should enable the NORDVPN-CONNECT-IP and/or EXPRESSVPN-CONNECT-IP blacklists.
  • A high criticality set with the IP addresses of the outbound VPN services. If you want to forbid the access of users of NordVPN and ExpressVPN then you should enable the NORDVPN-EXIT-IP and/or EXPRESSVPN-EXIT-IP blacklists.

How to enable these new lists

If you are new to Apility.io and you have not signed up yet (it’s free!), then you don’t need to do anything since these lists are enabled by default with all new accounts. If you already have an Apility.io account, then you have to log into the Dashboard, go to Blacklists to enable and disable the lists individually.

Apility.io deselect Free Mail

As an example in the animated GIF above we are enabling Freemail blacklists. You should do the same with your favorite lists in the IP addresses tab.