{"id":50182034,"url":"https://github.com/ipanalytics/vpn-provider-overlap-intelligence","last_synced_at":"2026-05-25T07:05:08.899Z","repository":{"id":358821771,"uuid":"1243231424","full_name":"ipanalytics/vpn-provider-overlap-intelligence","owner":"ipanalytics","description":"Aggregate VPN provider infrastructure overlap analysis: exact-IP overlap, shared /24 prefixes, hosting dependency, and provider relationship clusters. No raw VPN IP lists.","archived":false,"fork":false,"pushed_at":"2026-05-19T07:33:23.000Z","size":65,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-19T09:16:55.688Z","etag":null,"topics":["anti-fraud","asn","cybersecurity","data-analysis","fraud-detection","infrastructure","ip","ip-intelligence","ip-reputation","network-analysis","network-intelligence","osint","proxy-detection","threat-intelligence","vpn","vpn-detection"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ipanalytics.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-19T06:50:03.000Z","updated_at":"2026-05-19T07:33:27.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/ipanalytics/vpn-provider-overlap-intelligence","commit_stats":null,"previous_names":["ipanalytics/vpn-provider-overlap-intelligence"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/ipanalytics/vpn-provider-overlap-intelligence","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ipanalytics%2Fvpn-provider-overlap-intelligence","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ipanalytics%2Fvpn-provider-overlap-intelligence/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ipanalytics%2Fvpn-provider-overlap-intelligence/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ipanalytics%2Fvpn-provider-overlap-intelligence/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ipanalytics","download_url":"https://codeload.github.com/ipanalytics/vpn-provider-overlap-intelligence/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ipanalytics%2Fvpn-provider-overlap-intelligence/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33464014,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-25T06:32:55.349Z","status":"ssl_error","status_checked_at":"2026-05-25T06:32:35.322Z","response_time":57,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["anti-fraud","asn","cybersecurity","data-analysis","fraud-detection","infrastructure","ip","ip-intelligence","ip-reputation","network-analysis","network-intelligence","osint","proxy-detection","threat-intelligence","vpn","vpn-detection"],"created_at":"2026-05-25T07:04:42.617Z","updated_at":"2026-05-25T07:05:08.885Z","avatar_url":"https://github.com/ipanalytics.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# VPN Provider Overlap Intelligence\n\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"LICENSE\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/license-CC%20BY--NC%204.0-blue\" alt=\"License\"\u003e\n  \u003c/a\u003e\n\n  \u003ca href=\"https://github.com/ipanalytics/vpn-provider-overlap-intelligence\"\u003e\n    \u003cimg src=\"https://img.shields.io/github/last-commit/ipanalytics/vpn-provider-overlap-intelligence\" alt=\"Last Commit\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://github.com/ipanalytics/vpn-provider-overlap-intelligence\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/dataset-active-success\" alt=\"Dataset\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://github.com/ipanalytics/vpn-provider-overlap-intelligence\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/focus-provider_overlap-informational\" alt=\"Focus\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://github.com/ipanalytics/vpn-provider-overlap-intelligence\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/exports-csv-informational\" alt=\"Exports\"\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n---\n\nVPN Provider Overlap Intelligence is a public aggregate dataset for analyzing shared VPN infrastructure patterns across providers, hosting operators, ASNs, and network ranges.\n\nThe project focuses on infrastructure overlap signals derived from observed VPN network footprints, including exact shared IP observations, shared `/24` prefixes, hosting concentration, and provider relationship clustering.\n\nThe repository intentionally avoids publishing raw VPN IP inventories.\n\n---\n\n## Overview\n\nVPN providers frequently depend on overlapping infrastructure ecosystems:\n\n* shared hosting providers\n* leased datacenter ranges\n* reseller platforms\n* recycled address pools\n* common backend operators\n\nThis repository analyzes observable overlap relationships and publishes aggregate signals suitable for:\n\n* fraud detection\n* VPN/proxy research\n* infrastructure clustering\n* IP reputation enrichment\n* source quality analysis\n* risk feature engineering\n\nThe project is designed for analytical and defensive workflows rather than enforcement automation.\n\n---\n\n## Evidence Model\n\nRelationship analysis combines multiple independent infrastructure signals.\n\n| Evidence Layer        | Strength | Description                                           |\n| --------------------- | -------: | ----------------------------------------------------- |\n| Exact shared IP       |   Strong | Same IP observed under multiple provider identities   |\n| Shared `/24`          |   Medium | Providers overlap inside the same small network block |\n| Shared ASN            |  Context | Providers share hosting/operator footprint            |\n| Hosting concentration |  Context | Provider dependence on infrastructure operators       |\n| Relationship cluster  |  Derived | Repeated overlap across providers and networks        |\n\nThe public score is heuristic and bounded. It is not an ownership assertion.\n\n---\n\n## Architecture\n\n```text id=\"jlwm31\"\n             VPN Infrastructure Sources\n                          │\n       ┌──────────────────┼──────────────────┐\n       │                  │                  │\n       ▼                  ▼                  ▼\n   IP Observations    ASN Enrichment    Prefix Analysis\n       │                  │                  │\n       └──────────────────┴─────────┬────────┘\n                                    ▼\n                         Relationship Engine\n                 exact IP /24 / ASN correlation\n                                    ▼\n                           Cluster Analysis\n                                    ▼\n                              CSV Exports\n```\n\n---\n\n## Key Snapshot Findings\n\n### Strong Exact-IP Overlap Cluster\n\n```text id=\"jlwm32\"\nAnonine, BoxPN, EasyHideIP, Froot, FrootVPN\n```\n\nThis cluster shows repeated exact-IP overlap across multiple ASNs and network ranges.\n\nThe signal indicates strong infrastructure relationship evidence, but should not be interpreted as definitive ownership attribution.\n\n---\n\n## Top Provider Pairs\n\n| Provider A | Provider B    | Score | Confidence | Shared Exact IPs | Shared `/24` | Shared ASNs |\n| ---------- | ------------- | ----: | ---------- | ---------------: | -----------: | ----------: |\n| Anonine    | BoxPN         |   100 | high       |              290 |           56 |          31 |\n| Anonine    | EasyHideIP    |   100 | high       |              285 |           55 |          30 |\n| Anonine    | FrootVPN      |   100 | high       |              285 |           55 |          30 |\n| BoxPN      | EasyHideIP    |   100 | high       |              285 |           55 |          30 |\n| BoxPN      | FrootVPN      |   100 | high       |              285 |           55 |          30 |\n| EasyHideIP | FrootVPN      |   100 | high       |              285 |           55 |          30 |\n| Ivacy      | PureVPN       |    79 | high       |               27 |           20 |           9 |\n| Getflix    | Smartdnsproxy |    65 | medium     |               18 |           18 |          15 |\n| GhostPath  | SlickVPN      |    56 | medium     |               11 |           11 |          10 |\n\n---\n\n## Top Hosting Footprints\n\n| Hosting Organization | VPN IPs | Providers | Example Providers              |\n| -------------------- | ------: | --------: | ------------------------------ |\n| CDNEXT               |   5,282 |        21 | NordVPN, CyberGhost, ProtonVPN |\n| M247                 |   4,709 |        50 | NordVPN, AirVPN, ProtonVPN     |\n| NETPROTECT-62651     |   3,190 |         3 | WLVPN, IPVanish, StrongVPN     |\n| CLOUVIDER            |   2,844 |        10 | NordVPN, Astrill, IPVanish     |\n| PACKETHUBSA-AS-AP    |   2,186 |         1 | NordVPN                        |\n\n---\n\n## Published Datasets\n\n| File                                 | Description                                      |\n| ------------------------------------ | ------------------------------------------------ |\n| `provider_pair_exact_overlap.csv`    | Provider overlap relationship scores             |\n| `provider_relationship_clusters.csv` | Multi-provider overlap clusters                  |\n| `shared_prefix_examples.csv`         | `/24` overlap examples without raw IP disclosure |\n| `provider_hosting_dependency.csv`    | Per-provider hosting concentration               |\n| `hosting_company_footprint.csv`      | Hosting footprint rankings                       |\n| `provider_independence_score.csv`    | Infrastructure concentration metrics             |\n\n---\n\n## Relationship Scoring\n\nThe scoring model combines:\n\n* exact shared IP counts\n* shared `/24` counts\n* shared ASN counts\n\n### Confidence Levels\n\n| Confidence | Meaning                              |\n| ---------- | ------------------------------------ |\n| `high`     | Repeated strong exact-IP overlap     |\n| `medium`   | Meaningful overlap requiring context |\n| `low`      | Weak or sparse overlap signal        |\n\nScores are intended for analytical weighting, not binary classification.\n\n---\n\n## Usage Examples\n\n### Download overlap scores\n\n```bash id=\"jlwm33\"\ncurl -fsSLO \\\n  https://raw.githubusercontent.com/ipanalytics/vpn-provider-overlap-intelligence/main/data/provider_pair_exact_overlap.csv\n```\n\n### Extract high-confidence provider pairs\n\n```bash id=\"jlwm34\"\nawk -F, '$4 == \"high\" { print }' \\\n  provider_pair_exact_overlap.csv\n```\n\n### Find infrastructure clusters\n\n```bash id=\"jlwm35\"\ngrep -i \"NordVPN\" \\\n  provider_relationship_clusters.csv\n```\n\n### Analyze hosting concentration\n\n```bash id=\"jlwm36\"\nsort -t, -k2 -nr \\\n  hosting_company_footprint.csv | head\n```\n\n---\n\n## Operational Use Cases\n\n| Domain           | Example                              |\n| ---------------- | ------------------------------------ |\n| Fraud Detection  | VPN infrastructure correlation       |\n| SIEM Enrichment  | Provider relationship context        |\n| Threat Hunting   | Shared-hosting analysis              |\n| Research         | VPN ecosystem mapping                |\n| Abuse Prevention | Infrastructure concentration signals |\n| Analytics        | Hosting dependency analysis          |\n\n---\n\n## Safe Interpretation\n\nInfrastructure overlap alone does not imply:\n\n* common ownership\n* provider compromise\n* malicious activity\n* operational coordination\n\nShared infrastructure can result from:\n\n* reseller platforms\n* datacenter reuse\n* leased address pools\n* provider migrations\n* stale upstream datasets\n* white-label VPN ecosystems\n\nThe datasets should be treated as contextual infrastructure signals.\n\n---\n\n## Methodology\n\nAdditional methodology details:\n\n```text id=\"jlwm37\"\ndocs/methodology.md\n```\n\nSafe interpretation guidance:\n\n```text id=\"jlwm38\"\ndocs/safe_interpretation.md\n```\n\n---\n\n## Design Goals\n\n* aggregate-only publication\n* infrastructure-focused analysis\n* no raw VPN endpoint disclosure\n* lightweight CSV exports\n* reproducible overlap analysis\n* operationally safe enrichment signals\n\n---\n\n## Not Intended For\n\nThe project is not intended for:\n\n* ASN-wide blocking\n* ownership attribution\n* legal/compliance conclusions\n* standalone VPN detection\n* automated enforcement without additional telemetry\n\n---\n\n## Repository Layout\n\n```text id=\"jlwm39\"\n.\n├── data/\n├── docs/\n├── scripts/\n├── LICENSE\n└── README.md\n```\n\n---\n\n## Roadmap\n\nPlanned additions:\n\n* temporal overlap analysis\n* ASN historical trends\n* IPv6 overlap support\n* confidence weighting improvements\n* provider alias normalization\n* infrastructure lineage tracking\n\n---\n\n## License\n\nLicensed under CC BY-NC 4.0.\n\nSee [`LICENSE`](./LICENSE).\n\n---\n\n## Disclaimer\n\nThis repository publishes aggregate infrastructure overlap signals derived from observed VPN network patterns. The datasets are intended for analytical, operational, and defensive research workflows and should not be treated as definitive attribution evidence.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fipanalytics%2Fvpn-provider-overlap-intelligence","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fipanalytics%2Fvpn-provider-overlap-intelligence","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fipanalytics%2Fvpn-provider-overlap-intelligence/lists"}