Open
Description
We should be able to flag those.
Just some infos from Google/Gemini:
NordVPN
AS141039: This ASN is the main ASN used by NordVPN and is registered to PacketHub.
AS136787: This ASN is also used by NordVPN and is associated with
5464
PacketHub S.A..
AS147049 & AS207137: These are also listed as ASNs associated with NordVPN, likely indicating further connections or routing through different PacketHub networks, according to Netify.
ExpressVPN
AS137409:
This ASN is associated with IP addresses hosted by ExpressVPN, indicating a general ASN used for various ExpressVPN services.
AS206092:
This ASN is another example, specifically identified in a [proxy detection test by IPQS](https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/185.92.25.40), indicating it's used for ExpressVPN servers and IP ranges.
Other ASNs:
[BGPView](https://bgpview.io/prefix/102.165.41.0/24) also shows that ExpressVPN uses other ASNs, such as AS61317, for certain IP prefixes.
Apple iCloud Mask
https://mask-api.icloud.com/egress-ip-ranges.csv
Surfshark
AS209854