Mapping of egress points used by VPN providers
This is a follow up on my previous article about
In this article I was mapping different VPN provider’s internet egress points.
Now, half a year later I thought it was time for an updated on this mapping, since I have seen a few changes while using different VPN providers myself.
The mapping candidates
The countries I’m mapping against are the same as in my previous article.
- United Kindom
When selecting VPN providers, I have this time used a wider collection of providers, compared to my last article.
Kaspersky is not maintaining it’s own VPN service. It’s using the service from HotShield.
Test results – Overview
The results above show in some cases many different egress points of the same VPN provider in a particular country. (for example NordVPN) In other cases only one or two egress points are shown.
While testing and documenting the egress points of each VPN provider, is was limited to the functionality provided by the VPN provider’s application or the provided OpenVPN config files. Some of them offer the possibility to select unik servers to connect to. Or a unik server group (Express VPN). Others allow the user only to select the country to connect to. The actual egress point can be whatever the VPN provider is using. Anyway, even if some are not offering the possibility to select a unique server, different egress points could be documented in some cases (F-Secure Freedom in UK). That said, there is no guarantee that I managed to pick up all different egress points available for each VPN provider in the tested country.
Round up and summaries
As in my previous report, the company M247 Ltd is still the most used internet egress point all over Europe. It is used by nearly all VPN providers at least once (M247 is still not available in Sweden).
Following this is Obenetwork and Iomart.
NordVPN is the VPN provider with the highest number of unik egress points you can choose explicitly as a user. This is resulting in a large variation of different internet egress points in all tested countries.
Anyway, M247 Ltd is also used by NordVPN in all countries where this egress point is available.
IPVanish, felt a bit different compared to the others.
In many countries you will see the name “Eweka Internet Services B.V.” when checking your IP. It looks like this VPN provider is using their own unique infrastructure or mainly using this ISP. Most of the IPVanish’s egress points where connected this company. In UK, IPVanish didn’t seams to be connected to Eweka like in in Sweden, Netherlands and Germany.
Swedish VPN servers
The mapping shows clearly that there are two main server providers being used for VPN services in Sweden are Portlane and Obenetwork.
Both providers look like to have their own CDN (Content Delivery Network). Using my own VPS at Ditigal Ocean in Amsterdam, I performed a traceroute while connected to a Portlane or Obenetwork egress point. In those cases I saw that the traffic is not leaving Portlane’s or Obenetwork’network until servers in the Netherlands was reached.
Also when performing a traceroute to 126.96.36.199 or my own VPS while connected to AirVPN’s or ExpressVPN’s AltusHost egress point, the traffic is going from Altushost to Portlane, before reaching anything else. This is indicating that AltusHost must be some subcontracted customer to Portlane. Keeping that in mind, the number of VPN traffic coming through the Portlane’s network is even larger than my test results show. More about Portlane further below.
Swedish VPN providers
When taking a look at the Swedish VPN providers (OVPN, AzireVPN, PrivateVPN and Mullvad), we see that the most of them are using Obenetwork as their intenet egress point and that not only in Sweden.
Except of Mullvad which is using “31173 Services” in Sweden. Obenetwork is also been used by NordVPN, as only non-swedish VPN provider.
PrivateVPN is also using Resilans AB a lot outside Sweden. I have in the past seen that AzireVPN is using Resilans AB as well. But during my tests now only Obenetwork was showing up there. Also to mention is that AzireVPN did only provide egress points in two of tested countries. But because AzireVPN is discussed and recommended in different Swedish internet forums, I included it to the list of test candidates.
Taking a look at the most used egress point in Europe (M247 Ltd), this one is also been used by PrivateVPN and Mullvad outside Sweden.
Portlane has been recently in the Swedish IT-Security news, due to the news about “one customer” of Portlane to be a victim of the Cloud Hopper attack (APT10).
That said, no detailed information about the customer in question was released. The victim could be one of the many VPN providers using Portlane, but it could be any other customer of Portlane.
Thinking about VPN egress points, including a lot of traffic from many users, the company providing the egress point could be a welcome target for many APT actors.
This gets me right back to the question I had in mind in my previous article “Are VPN providers more trustworthy than your local ISP?“
Enjoy reading. 🙂
Other articles published about VPN services: