iporigin 1.0.0__tar.gz → 1.1.1__tar.gz

iporigin-1.1.1/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+## 1.1.0
+
+- 11 more providers, from two repositories used with their maintainers'
+  permission: Cogent, DataCamp, Contabo, Vercel, CDN77, GleSYS, Scalaxy,
+  GTHost, Melbicom, BuyVM, BunnyCDN, plus extra Akamai ranges.
+  37 providers to 48; 33,647 ranges to 38,379; IPv4 coverage 248M to 287M
+  addresses.
+- NOTICE records every data source, its licence, and — where a repository
+  has none — the permission it is used under.
+- `jhassine/server-ip-addresses` was measured and deliberately left out:
+  every one of 211,616 sampled addresses was already covered, so it adds
+  nothing but another endpoint that can break the weekly rebuild.
+
+## 1.0.0
+
+First release.
+
+- Offline classification of IPv4 and IPv6 addresses into `hosting`, `cdn`,
+  `vpn`, `tor`, `bot`, `reserved` and `unknown`, from a table of 33,647
+  disjoint ranges covering 37 providers.
+- Ten providers come from their own published feeds; the rest — Hetzner,
+  OVHcloud, Akamai, Mullvad, ProtonVPN, Tor, Googlebot and others — from two
+  CC0 community lists, because those providers publish nothing
+  machine-readable.
+- `classify`, `is_datacenter`, `classify_many`, `dataset_info`, plus the
+  `DATACENTER_KINDS` and `ANONYMIZER_KINDS` sets.
+- `iporigin` command line tool, reads addresses from arguments or stdin.
+- Optional live lookup in `iporigin.online` for VPN providers the offline
+  table does not reach.
+- No runtime dependencies.

iporigin-1.1.1/MANIFEST.in

@@ -0,0 +1,7 @@
+include LICENSE
+include NOTICE
+include CHANGELOG.md
+include README.md
+include src/iporigin/data/ranges.bin
+recursive-include tools *.py
+recursive-include tests *.py

iporigin-1.1.1/NOTICE

@@ -0,0 +1,78 @@
+Third-party data sources
+========================
+
+iporigin's bundled dataset (src/iporigin/data/ranges.bin) is compiled from
+the sources listed in tools/sources.py. iporigin's own code is MIT; the data
+comes from elsewhere and is recorded here so that anyone redistributing this
+package knows exactly what they are redistributing.
+
+
+1. Published by the provider
+----------------------------
+
+Amazon AWS, Google, Google Cloud, Microsoft Azure, DigitalOcean, Linode,
+Vultr, Oracle Cloud, GitHub, Cloudflare, Fastly.
+
+Each is the operator's own published feed, issued for the purpose of being
+consumed programmatically. No separate permission is needed or claimed.
+
+
+2. CC0-1.0 community aggregations
+---------------------------------
+
+  rezmoss/cloud-provider-ip-addresses   CC0-1.0
+  https://github.com/rezmoss/cloud-provider-ip-addresses
+
+  lord-alfred/ipranges                  CC0-1.0
+  https://github.com/lord-alfred/ipranges
+
+CC0 is a public-domain dedication, so these carry no conditions.
+
+
+3. Used with the maintainer's permission
+----------------------------------------
+
+These repositories publish no licence file. Under default copyright that
+means all rights reserved, and they would otherwise be unusable here.
+They are included because permission was obtained from each maintainer
+directly, by Serdar Akarca of Yuix Networks, prior to the 1.1.0 release
+(2026-09-13). The maintainers' position as relayed was that the lists were
+published for general use.
+
+  123jjck/cdn-ip-ranges
+  https://github.com/123jjck/cdn-ip-ranges
+  Used for: Cogent, DataCamp, Contabo, Vercel, CDN77, GleSYS, Scalaxy,
+            GTHost, Melbicom, BuyVM, BunnyCDN
+
+  SecOps-Institute/Akamai-ASN-and-IPs-List
+  https://github.com/SecOps-Institute/Akamai-ASN-and-IPs-List
+  Used for: additional Akamai ranges
+
+TODO for the maintainer: attach the written record of each permission below
+(issue link, PR link or email date). Until that is here, the grant rests on
+a verbal account, which is thinner than a licence and worth replacing. The
+cleanest fix is a PR to each repository adding a licence file — that removes
+the question for everyone downstream, not just for us.
+
+  123jjck/cdn-ip-ranges                     evidence: <to be added>
+  SecOps-Institute/Akamai-ASN-and-IPs-List  evidence: <to be added>
+
+
+Sources deliberately excluded
+-----------------------------
+
+Measured and left out because they add nothing, not for licensing reasons:
+
+  jhassine/server-ip-addresses
+    52,772 prefixes covering 227M addresses. Every one of 211,616 sampled
+    addresses was already covered by the tiers above — it is a subset of
+    the provider feeds it was itself built from.
+
+  Pymmdrza/Datacenter_List_DataBase_IP
+    1,280 new addresses beyond Hetzner's other sources.
+
+  SM443/IP-Prefix-List
+    No parseable CIDR content at the referenced paths.
+
+A source that adds nothing still costs something: another endpoint that can
+break the weekly rebuild.

{iporigin-1.0.0/src/iporigin.egg-info → iporigin-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iporigin
-Version: 1.0.0
+Version: 1.1.1
 Summary: Is this IP a datacenter, VPN, Tor exit or a home connection? Offline lookup, no API key.
 Author-email: Yuix Networks <info@yuix.org>
 License: MIT
@@ -28,6 +28,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
+License-File: NOTICE
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Dynamic: license-file
@@ -47,7 +48,7 @@ False
 ```
 
 No network calls. No signup. No runtime dependencies. The answer comes from
-a bundled table of 33,000 ranges covering 37 hosting providers, CDNs,
+a bundled table of 38,000 ranges covering 48 hosting providers, CDNs,
 consumer VPNs, Tor and declared crawlers.
 
 ## Install
@@ -154,7 +155,7 @@ import this module on purpose. No key required.
 
 ## What is in the dataset
 
-37 providers, in two tiers.
+48 providers, in three tiers.
 
 **Published by the provider.** The authoritative tier — each of these is the
 company's own feed, fetched at build time:
@@ -186,19 +187,44 @@ Covering Hetzner, OVHcloud, Scaleway, Alibaba Cloud, Leaseweb, UpCloud, IBM
 Cloud, Huawei Cloud, Tencent Cloud, Rackspace, Akamai, Gcore, Mullvad,
 ProtonVPN, Apple Private Relay, Tor, and ten declared crawlers.
 
-Both are CC0, which is why these two and not the half-dozen other repos
-covering the same ground. Redistributing an unlicensed list inside an MIT
-package is not something a dependency should ask of the people who install
-it.
+Both are CC0, a public-domain dedication, so they carry no conditions.
 
-About 449,000 published prefixes collapse into 33,647 disjoint ranges
-(17,169 IPv4, 16,478 IPv6). Rebuild it yourself at any time:
+**Used with the maintainer's permission.** Two further repositories publish
+no licence file, which normally rules them out. They are included because
+permission was obtained from each maintainer directly — see
+[NOTICE](NOTICE), which records what was granted and by whom:
+
+- [`123jjck/cdn-ip-ranges`](https://github.com/123jjck/cdn-ip-ranges) —
+  Cogent, DataCamp, Contabo, Vercel, CDN77, GleSYS, Scalaxy, GTHost,
+  Melbicom, BuyVM, BunnyCDN
+- [`SecOps-Institute/Akamai-ASN-and-IPs-List`](https://github.com/SecOps-Institute/Akamai-ASN-and-IPs-List) —
+  additional Akamai ranges
+
+Only what is additive is taken. `jhassine/server-ip-addresses` is the
+best-known list of this kind and is **not** included: 52,772 prefixes,
+227M addresses, and every one of 211,616 sampled addresses was already
+covered. It is a subset of the provider feeds it was itself built from, and
+a source that adds nothing is still another endpoint that can break the
+weekly rebuild.
+
+About 454,000 published prefixes collapse into roughly 38,400 disjoint
+ranges (about 21,900 IPv4 and 16,500 IPv6) covering 287 million IPv4
+addresses. The exact figures move every week with the feeds; the build
+prints them. Rebuild it yourself at any time:
 
 ```
 python tools/build_dataset.py
 ```
 
-A GitHub Action re-runs that weekly and opens a PR when the ranges move.
+A GitHub Action re-runs that weekly and commits the result when the ranges
+move, and a second one cuts a patch release on the 6th of each month if the
+dataset changed since the last release — so `pip install --upgrade iporigin`
+is never more than about a month behind the feeds, and a quiet month
+produces no release rather than a version whose only content is a new
+number. The build refuses to replace the committed dataset if it shrinks by
+more than 20% — a feed that starts answering with an empty body looks
+exactly like a provider giving up its address space, and nothing else
+would catch it. Pass `--allow-shrink` when the drop is genuine.
 
 ### Known gaps
 
@@ -209,8 +235,8 @@ Being explicit about these is more useful than pretending they are not there:
 - **Some provider-owned addresses** sit outside the ranges the provider
   publishes. `1.1.1.1` is Cloudflare's resolver but is not in Cloudflare's
   published edge list, so it comes back `unknown`.
-- **Second-hand data is second-hand.** The community tier is as good as
-  those repos are, and they are not the provider speaking.
+- **Second-hand data is second-hand.** Tiers 2 and 3 are as good as those
+  repos are, and they are not the provider speaking.
 - The data is **as accurate as the feeds**. A range reassigned yesterday is
   wrong until the next rebuild.
 
@@ -237,8 +263,9 @@ Python 3.8+. No dependencies.
 
 ## License
 
-MIT. The compiled dataset is derived from the providers' own public feeds,
-each published for exactly this purpose.
+The code is MIT. The bundled dataset comes from third parties; every source,
+its licence, and — where there is none — the permission it is used under are
+recorded in [NOTICE](NOTICE).
 
 ---
 

{iporigin-1.0.0 → iporigin-1.1.1}/README.md

@@ -13,7 +13,7 @@ False
 ```
 
 No network calls. No signup. No runtime dependencies. The answer comes from
-a bundled table of 33,000 ranges covering 37 hosting providers, CDNs,
+a bundled table of 38,000 ranges covering 48 hosting providers, CDNs,
 consumer VPNs, Tor and declared crawlers.
 
 ## Install
@@ -120,7 +120,7 @@ import this module on purpose. No key required.
 
 ## What is in the dataset
 
-37 providers, in two tiers.
+48 providers, in three tiers.
 
 **Published by the provider.** The authoritative tier — each of these is the
 company's own feed, fetched at build time:
@@ -152,19 +152,44 @@ Covering Hetzner, OVHcloud, Scaleway, Alibaba Cloud, Leaseweb, UpCloud, IBM
 Cloud, Huawei Cloud, Tencent Cloud, Rackspace, Akamai, Gcore, Mullvad,
 ProtonVPN, Apple Private Relay, Tor, and ten declared crawlers.
 
-Both are CC0, which is why these two and not the half-dozen other repos
-covering the same ground. Redistributing an unlicensed list inside an MIT
-package is not something a dependency should ask of the people who install
-it.
+Both are CC0, a public-domain dedication, so they carry no conditions.
 
-About 449,000 published prefixes collapse into 33,647 disjoint ranges
-(17,169 IPv4, 16,478 IPv6). Rebuild it yourself at any time:
+**Used with the maintainer's permission.** Two further repositories publish
+no licence file, which normally rules them out. They are included because
+permission was obtained from each maintainer directly — see
+[NOTICE](NOTICE), which records what was granted and by whom:
+
+- [`123jjck/cdn-ip-ranges`](https://github.com/123jjck/cdn-ip-ranges) —
+  Cogent, DataCamp, Contabo, Vercel, CDN77, GleSYS, Scalaxy, GTHost,
+  Melbicom, BuyVM, BunnyCDN
+- [`SecOps-Institute/Akamai-ASN-and-IPs-List`](https://github.com/SecOps-Institute/Akamai-ASN-and-IPs-List) —
+  additional Akamai ranges
+
+Only what is additive is taken. `jhassine/server-ip-addresses` is the
+best-known list of this kind and is **not** included: 52,772 prefixes,
+227M addresses, and every one of 211,616 sampled addresses was already
+covered. It is a subset of the provider feeds it was itself built from, and
+a source that adds nothing is still another endpoint that can break the
+weekly rebuild.
+
+About 454,000 published prefixes collapse into roughly 38,400 disjoint
+ranges (about 21,900 IPv4 and 16,500 IPv6) covering 287 million IPv4
+addresses. The exact figures move every week with the feeds; the build
+prints them. Rebuild it yourself at any time:
 
 ```
 python tools/build_dataset.py
 ```
 
-A GitHub Action re-runs that weekly and opens a PR when the ranges move.
+A GitHub Action re-runs that weekly and commits the result when the ranges
+move, and a second one cuts a patch release on the 6th of each month if the
+dataset changed since the last release — so `pip install --upgrade iporigin`
+is never more than about a month behind the feeds, and a quiet month
+produces no release rather than a version whose only content is a new
+number. The build refuses to replace the committed dataset if it shrinks by
+more than 20% — a feed that starts answering with an empty body looks
+exactly like a provider giving up its address space, and nothing else
+would catch it. Pass `--allow-shrink` when the drop is genuine.
 
 ### Known gaps
 
@@ -175,8 +200,8 @@ Being explicit about these is more useful than pretending they are not there:
 - **Some provider-owned addresses** sit outside the ranges the provider
   publishes. `1.1.1.1` is Cloudflare's resolver but is not in Cloudflare's
   published edge list, so it comes back `unknown`.
-- **Second-hand data is second-hand.** The community tier is as good as
-  those repos are, and they are not the provider speaking.
+- **Second-hand data is second-hand.** Tiers 2 and 3 are as good as those
+  repos are, and they are not the provider speaking.
 - The data is **as accurate as the feeds**. A range reassigned yesterday is
   wrong until the next rebuild.
 
@@ -203,8 +228,9 @@ Python 3.8+. No dependencies.
 
 ## License
 
-MIT. The compiled dataset is derived from the providers' own public feeds,
-each published for exactly this purpose.
+The code is MIT. The bundled dataset comes from third parties; every source,
+its licence, and — where there is none — the permission it is used under are
+recorded in [NOTICE](NOTICE).
 
 ---
 

{iporigin-1.0.0 → iporigin-1.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "iporigin"
-version = "1.0.0"
+version = "1.1.1"
 description = "Is this IP a datacenter, VPN, Tor exit or a home connection? Offline lookup, no API key."
 readme = "README.md"
 requires-python = ">=3.8"
@@ -49,6 +49,9 @@ iporigin = "iporigin.cli:main"
 [project.optional-dependencies]
 dev = ["pytest>=7"]
 
+[tool.setuptools]
+license-files = ["LICENSE", "NOTICE"]
+
 [tool.setuptools.packages.find]
 where = ["src"]
 

{iporigin-1.0.0 → iporigin-1.1.1}/src/iporigin/__init__.py

@@ -29,7 +29,7 @@ from .core import (
     is_datacenter,
 )
 
-__version__ = "1.0.0"
+__version__ = "1.1.1"
 
 __all__ = [
     "ANONYMIZER_KINDS",

{iporigin-1.0.0 → iporigin-1.1.1/src/iporigin.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iporigin
-Version: 1.0.0
+Version: 1.1.1
 Summary: Is this IP a datacenter, VPN, Tor exit or a home connection? Offline lookup, no API key.
 Author-email: Yuix Networks <info@yuix.org>
 License: MIT
@@ -28,6 +28,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
+License-File: NOTICE
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Dynamic: license-file
@@ -47,7 +48,7 @@ False
 ```
 
 No network calls. No signup. No runtime dependencies. The answer comes from
-a bundled table of 33,000 ranges covering 37 hosting providers, CDNs,
+a bundled table of 38,000 ranges covering 48 hosting providers, CDNs,
 consumer VPNs, Tor and declared crawlers.
 
 ## Install
@@ -154,7 +155,7 @@ import this module on purpose. No key required.
 
 ## What is in the dataset
 
-37 providers, in two tiers.
+48 providers, in three tiers.
 
 **Published by the provider.** The authoritative tier — each of these is the
 company's own feed, fetched at build time:
@@ -186,19 +187,44 @@ Covering Hetzner, OVHcloud, Scaleway, Alibaba Cloud, Leaseweb, UpCloud, IBM
 Cloud, Huawei Cloud, Tencent Cloud, Rackspace, Akamai, Gcore, Mullvad,
 ProtonVPN, Apple Private Relay, Tor, and ten declared crawlers.
 
-Both are CC0, which is why these two and not the half-dozen other repos
-covering the same ground. Redistributing an unlicensed list inside an MIT
-package is not something a dependency should ask of the people who install
-it.
+Both are CC0, a public-domain dedication, so they carry no conditions.
 
-About 449,000 published prefixes collapse into 33,647 disjoint ranges
-(17,169 IPv4, 16,478 IPv6). Rebuild it yourself at any time:
+**Used with the maintainer's permission.** Two further repositories publish
+no licence file, which normally rules them out. They are included because
+permission was obtained from each maintainer directly — see
+[NOTICE](NOTICE), which records what was granted and by whom:
+
+- [`123jjck/cdn-ip-ranges`](https://github.com/123jjck/cdn-ip-ranges) —
+  Cogent, DataCamp, Contabo, Vercel, CDN77, GleSYS, Scalaxy, GTHost,
+  Melbicom, BuyVM, BunnyCDN
+- [`SecOps-Institute/Akamai-ASN-and-IPs-List`](https://github.com/SecOps-Institute/Akamai-ASN-and-IPs-List) —
+  additional Akamai ranges
+
+Only what is additive is taken. `jhassine/server-ip-addresses` is the
+best-known list of this kind and is **not** included: 52,772 prefixes,
+227M addresses, and every one of 211,616 sampled addresses was already
+covered. It is a subset of the provider feeds it was itself built from, and
+a source that adds nothing is still another endpoint that can break the
+weekly rebuild.
+
+About 454,000 published prefixes collapse into roughly 38,400 disjoint
+ranges (about 21,900 IPv4 and 16,500 IPv6) covering 287 million IPv4
+addresses. The exact figures move every week with the feeds; the build
+prints them. Rebuild it yourself at any time:
 
 ```
 python tools/build_dataset.py
 ```
 
-A GitHub Action re-runs that weekly and opens a PR when the ranges move.
+A GitHub Action re-runs that weekly and commits the result when the ranges
+move, and a second one cuts a patch release on the 6th of each month if the
+dataset changed since the last release — so `pip install --upgrade iporigin`
+is never more than about a month behind the feeds, and a quiet month
+produces no release rather than a version whose only content is a new
+number. The build refuses to replace the committed dataset if it shrinks by
+more than 20% — a feed that starts answering with an empty body looks
+exactly like a provider giving up its address space, and nothing else
+would catch it. Pass `--allow-shrink` when the drop is genuine.
 
 ### Known gaps
 
@@ -209,8 +235,8 @@ Being explicit about these is more useful than pretending they are not there:
 - **Some provider-owned addresses** sit outside the ranges the provider
   publishes. `1.1.1.1` is Cloudflare's resolver but is not in Cloudflare's
   published edge list, so it comes back `unknown`.
-- **Second-hand data is second-hand.** The community tier is as good as
-  those repos are, and they are not the provider speaking.
+- **Second-hand data is second-hand.** Tiers 2 and 3 are as good as those
+  repos are, and they are not the provider speaking.
 - The data is **as accurate as the feeds**. A range reassigned yesterday is
   wrong until the next rebuild.
 
@@ -237,8 +263,9 @@ Python 3.8+. No dependencies.
 
 ## License
 
-MIT. The compiled dataset is derived from the providers' own public feeds,
-each published for exactly this purpose.
+The code is MIT. The bundled dataset comes from third parties; every source,
+its licence, and — where there is none — the permission it is used under are
+recorded in [NOTICE](NOTICE).
 
 ---
 

{iporigin-1.0.0 → iporigin-1.1.1}/src/iporigin.egg-info/SOURCES.txt

@@ -1,4 +1,7 @@
+CHANGELOG.md
 LICENSE
+MANIFEST.in
+NOTICE
 README.md
 pyproject.toml
 src/iporigin/__init__.py
@@ -14,4 +17,7 @@ src/iporigin.egg-info/entry_points.txt
 src/iporigin.egg-info/requires.txt
 src/iporigin.egg-info/top_level.txt
 src/iporigin/data/ranges.bin
-tests/test_iporigin.py
+tests/test_iporigin.py
+tools/build_dataset.py
+tools/bump_version.py
+tools/sources.py

{iporigin-1.0.0 → iporigin-1.1.1}/tests/test_iporigin.py

@@ -363,3 +363,148 @@ def _stub_api(monkeypatch, payload):
         yield Response()
 
     monkeypatch.setattr(online.urllib.request, "urlopen", fake_urlopen)
+
+
+# --- the build guard -------------------------------------------------------
+#
+# The weekly refresh commits straight to main, so this check is the only
+# thing standing between a broken upstream feed and a shipped dataset.
+
+
+def _build_module():
+    import importlib.util
+    import pathlib
+
+    path = pathlib.Path(__file__).parent.parent / "tools" / "build_dataset.py"
+    spec = importlib.util.spec_from_file_location("build_dataset", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_a_large_shrink_is_refused():
+    build = _build_module()
+    assert build.shrink_complaint(30000, 5000) is not None
+
+
+def test_a_normal_week_is_allowed():
+    """Feeds move by a few percent all the time."""
+    build = _build_module()
+    assert build.shrink_complaint(30000, 29000) is None
+    assert build.shrink_complaint(30000, 31500) is None
+
+
+def test_growth_is_never_refused():
+    build = _build_module()
+    assert build.shrink_complaint(1000, 100000) is None
+
+
+def test_the_first_ever_build_is_allowed():
+    """No committed dataset to compare against."""
+    build = _build_module()
+    assert build.shrink_complaint(None, 10) is None
+    assert build.shrink_complaint(0, 10) is None
+
+
+def test_the_threshold_is_the_documented_one():
+    build = _build_module()
+    assert build.MAX_SHRINK == 0.20
+    # Exactly at the limit passes; a hair below does not.
+    assert build.shrink_complaint(1000, 800) is None
+    assert build.shrink_complaint(1000, 799) is not None
+
+
+def test_the_complaint_says_what_to_do():
+    build = _build_module()
+    message = build.shrink_complaint(30000, 5000)
+    assert "--allow-shrink" in message
+    assert "5000" in message and "30000" in message
+
+
+def test_existing_range_count_reads_the_committed_dataset():
+    build = _build_module()
+    count = build.existing_range_count()
+    assert count and count > 1000
+
+
+def test_existing_range_count_survives_a_missing_or_corrupt_file(tmp_path, monkeypatch):
+    build = _build_module()
+    monkeypatch.setattr(build, "OUT", tmp_path / "absent.bin")
+    assert build.existing_range_count() is None
+
+    corrupt = tmp_path / "ranges.bin"
+    corrupt.write_bytes(b"nope")
+    monkeypatch.setattr(build, "OUT", corrupt)
+    assert build.existing_range_count() is None
+
+
+# --- the release bump ------------------------------------------------------
+#
+# Releases are cut by a scheduled job, so a bump that goes half-way lands on
+# PyPI before anyone looks at it.
+
+
+def _bump_module():
+    import importlib.util
+    import pathlib
+
+    path = pathlib.Path(__file__).parent.parent / "tools" / "bump_version.py"
+    spec = importlib.util.spec_from_file_location("bump_version", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_the_two_declared_versions_agree():
+    """pyproject.toml and __init__.py each hold the version separately."""
+    bump = _bump_module()
+    declared, exported = bump.read_versions(
+        bump.PYPROJECT.read_text(), bump.INIT.read_text()
+    )
+    assert declared == exported == iporigin.__version__
+
+
+def test_patch_bump():
+    bump = _bump_module()
+    assert bump.next_patch("1.1.0") == "1.1.1"
+    assert bump.next_patch("1.1.9") == "1.1.10"
+    assert bump.next_patch("0.0.0") == "0.0.1"
+
+
+def test_a_non_numeric_version_is_left_alone():
+    bump = _bump_module()
+    for bad in ("2.0.0rc1", "1.1", "1.1.0.post1", "v1.1.0"):
+        with pytest.raises(ValueError):
+            bump.next_patch(bad)
+
+
+def test_bump_rewrites_both_files():
+    bump = _bump_module()
+    pyproject, init, new = bump.bump(
+        'name = "iporigin"\nversion = "1.2.3"\n', '__version__ = "1.2.3"\n'
+    )
+    assert new == "1.2.4"
+    assert 'version = "1.2.4"' in pyproject
+    assert '__version__ = "1.2.4"' in init
+
+
+def test_bump_refuses_when_the_files_disagree():
+    bump = _bump_module()
+    with pytest.raises(ValueError, match="fix that before releasing"):
+        bump.bump('version = "1.2.3"\n', '__version__ = "1.0.0"\n')
+
+
+def test_bump_refuses_when_a_declaration_is_missing():
+    bump = _bump_module()
+    with pytest.raises(ValueError, match="pyproject"):
+        bump.read_versions("name = \"iporigin\"\n", '__version__ = "1.0.0"\n')
+    with pytest.raises(ValueError, match="__init__"):
+        bump.read_versions('version = "1.0.0"\n', "x = 1\n")
+
+
+def test_bump_only_touches_the_version_line():
+    """pyproject holds other quoted values; a greedy substitution eats them."""
+    bump = _bump_module()
+    source = 'version = "1.2.3"\nrequires-python = ">=3.8"\n'
+    pyproject, _init, _new = bump.bump(source, '__version__ = "1.2.3"\n')
+    assert 'requires-python = ">=3.8"' in pyproject

iporigin-1.1.1/tools/build_dataset.py

@@ -0,0 +1,231 @@
+#!/usr/bin/env python3
+"""Compile the published provider feeds into src/iporigin/data/ranges.bin.
+
+Run it by hand or let .github/workflows/update-data.yml do it weekly:
+
+    python tools/build_dataset.py
+
+Format (all integers little-endian):
+
+    magic     8s   b"IPORIGIN"
+    version   H    format version, currently 1
+    built_at  Q    unix timestamp of the build
+    n_labels  H
+    n_v4      I
+    n_v6      I
+    labels         n_labels x (H length + utf-8 "provider\\tkind")
+    v4 table       n_v4 x (I start, I end, H label)
+    v6 table       n_v6 x (16s start, 16s end, H label)
+
+Ranges are stored as inclusive start/end integers rather than CIDR prefixes
+because a lookup is then one bisect over a sorted column, with no prefix
+arithmetic at query time. They are sorted by start and merged where a
+provider's own feed overlaps itself, which the cloud feeds do constantly.
+"""
+
+import ipaddress
+import struct
+import sys
+import time
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent))
+
+from sources import SOURCES  # noqa: E402
+
+MAGIC = b"IPORIGIN"
+VERSION = 1
+OUT = Path(__file__).parent.parent / "src" / "iporigin" / "data" / "ranges.bin"
+
+
+def collect():
+    """Fetch every source. Returns (v4, v6) lists of (start, end, label)."""
+    v4, v6 = [], []
+    for name, (kind, fetch) in SOURCES.items():
+        label = "%s\t%s" % (name, kind)
+        count = 0
+        try:
+            for prefix in fetch():
+                try:
+                    net = ipaddress.ip_network(prefix.strip(), strict=False)
+                except ValueError:
+                    continue
+                record = (
+                    int(net.network_address),
+                    int(net.broadcast_address),
+                    label,
+                )
+                (v4 if net.version == 4 else v6).append(record)
+                count += 1
+        except Exception as exc:  # noqa: BLE001 — see module docstring
+            print("  !! %-18s skipped: %s" % (name, exc), file=sys.stderr)
+            continue
+        print("  %-18s %6d prefixes" % (name, count))
+    return v4, v6
+
+
+def flatten(records):
+    """Turn overlapping ranges into a disjoint, sorted table.
+
+    Two things make this necessary rather than a nicety:
+
+    * Feeds overlap each other. GitHub runs on Azure and AWS, so its
+      prefixes sit inside theirs; Google publishes goog.json and cloud.json
+      which share space.
+    * The lookup is a bisect that inspects exactly one candidate — the last
+      range whose start is <= the address. With overlapping ranges that
+      candidate can be a narrow range that ends before the address while a
+      wider range still contains it, and the lookup returns "unknown" for an
+      address that is plainly in the table.
+
+    Where ranges overlap, the narrowest one wins: GitHub inside Azure should
+    answer GitHub, which is the more specific truth.
+    """
+    import heapq
+
+    if not records:
+        return []
+
+    events = []
+    for index, (start, end, label) in enumerate(records):
+        events.append((start, 0, index))        # range opens
+        events.append((end + 1, 1, index))      # range closes
+    events.sort()
+
+    active = []           # heap of (width, index)
+    ends = {}
+    for index, (start, end, _) in enumerate(records):
+        ends[index] = end
+
+    segments = []
+    position = events[0][0]
+    event_index = 0
+    total = len(events)
+
+    while event_index < total:
+        point = events[event_index][0]
+
+        # Emit the segment that ends where this event begins.
+        if point > position:
+            while active and ends[active[0][1]] < position:
+                heapq.heappop(active)
+            if active:
+                _, winner = active[0]
+                segments.append((position, point - 1, records[winner][2]))
+            position = point
+
+        while event_index < total and events[event_index][0] == point:
+            _, kind, index = events[event_index]
+            if kind == 0:
+                start, end, _ = records[index]
+                heapq.heappush(active, (end - start, index))
+            event_index += 1
+
+        # Closing events are handled lazily by the pop above; pushing the
+        # close event only serves to create a segment boundary here.
+
+    # Coalesce neighbours that ended up with the same label.
+    merged = []
+    for start, end, label in segments:
+        if merged and merged[-1][2] == label and start <= merged[-1][1] + 1:
+            merged[-1] = (merged[-1][0], max(merged[-1][1], end), label)
+        else:
+            merged.append((start, end, label))
+    return merged
+
+
+def pack(v4, v6):
+    labels = []
+    index = {}
+    for _, _, label in v4 + v6:
+        if label not in index:
+            index[label] = len(labels)
+            labels.append(label)
+
+    out = bytearray()
+    out += struct.pack("<8sHQHII", MAGIC, VERSION, int(time.time()), len(labels), len(v4), len(v6))
+    for label in labels:
+        raw = label.encode("utf-8")
+        out += struct.pack("<H", len(raw)) + raw
+    for start, end, label in v4:
+        out += struct.pack("<IIH", start, end, index[label])
+    for start, end, label in v6:
+        out += struct.pack("<16s16sH",
+                           start.to_bytes(16, "big"), end.to_bytes(16, "big"), index[label])
+    return bytes(out)
+
+
+#: Refuse to replace the dataset if it shrinks by more than this. A source
+#: that starts answering 200 with an empty body, or quietly changes its JSON
+#: shape, looks exactly like a provider giving up its address space — and
+#: nothing else in the pipeline would notice.
+MAX_SHRINK = 0.20
+
+
+def existing_range_count():
+    """How many ranges the committed dataset holds, or None if there is none."""
+    if not OUT.exists():
+        return None
+    try:
+        blob = OUT.read_bytes()
+        magic, _version, _built, _labels, n_v4, n_v6 = struct.unpack_from("<8sHQHII", blob, 0)
+    except Exception:
+        return None
+    if magic != MAGIC:
+        return None
+    return n_v4 + n_v6
+
+
+def shrink_complaint(previous, current, max_shrink=None):
+    """Why this build must not replace the committed one, or None.
+
+    A source that starts answering 200 with an empty body, or quietly
+    changes its JSON shape, looks exactly like a provider giving up its
+    address space. Nothing else in the pipeline notices, and since the
+    refresh now commits straight to main there is no review that would.
+    """
+    limit = MAX_SHRINK if max_shrink is None else max_shrink
+    if not previous or current >= previous * (1 - limit):
+        return None
+    return (
+        "Refusing to write: %d ranges is %.0f%% below the %d already "
+        "committed. Either several sources failed at once, or one changed "
+        "shape and is now parsing to nothing. Check the per-source counts "
+        "above, then override with --allow-shrink if it is genuine."
+        % (current, 100 * (1 - current / previous), previous)
+    )
+
+
+def main(allow_shrink=False):
+    print("Fetching provider feeds...")
+    v4, v6 = collect()
+    if not v4:
+        # Every source failing at once means something is wrong with the
+        # runner, not with ten providers. Refuse to ship an empty dataset
+        # over a good one.
+        print("No IPv4 ranges collected; refusing to write an empty dataset.", file=sys.stderr)
+        return 1
+
+    before = len(v4) + len(v6)
+    v4, v6 = flatten(v4), flatten(v6)
+    blob = pack(v4, v6)
+
+    # The last line of defence now that nothing downstream reviews this.
+    complaint = None if allow_shrink else shrink_complaint(
+        existing_range_count(), len(v4) + len(v6)
+    )
+    if complaint:
+        print(complaint, file=sys.stderr)
+        return 1
+
+    OUT.parent.mkdir(parents=True, exist_ok=True)
+    OUT.write_bytes(blob)
+
+    print("\n%d prefixes -> %d ranges (%d v4, %d v6), %.1f KB"
+          % (before, len(v4) + len(v6), len(v4), len(v6), len(blob) / 1024))
+    print("written to %s" % OUT)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(allow_shrink="--allow-shrink" in sys.argv))

iporigin-1.1.1/tools/bump_version.py

@@ -0,0 +1,84 @@
+"""Bump the patch version, in both of the places that hold it.
+
+The version lives in pyproject.toml (what PyPI sees) and in
+src/iporigin/__init__.py (what `iporigin --version` and any caller sees).
+Nothing enforces that they agree, and a release that bumps one of them
+ships a package that lies about itself — so this refuses to touch either
+unless they start out identical.
+"""
+import pathlib
+import re
+import sys
+
+ROOT = pathlib.Path(__file__).resolve().parent.parent
+PYPROJECT = ROOT / "pyproject.toml"
+INIT = ROOT / "src" / "iporigin" / "__init__.py"
+
+PYPROJECT_RE = re.compile(r'^version = "([^"]+)"', re.M)
+INIT_RE = re.compile(r'^__version__ = "([^"]+)"', re.M)
+
+
+def read_versions(pyproject_text, init_text):
+    """The declared version in each file, as a pair."""
+    found = []
+    for pattern, text, where in (
+        (PYPROJECT_RE, pyproject_text, "pyproject.toml"),
+        (INIT_RE, init_text, "__init__.py"),
+    ):
+        match = pattern.search(text)
+        if not match:
+            raise ValueError("no version declaration found in %s" % where)
+        found.append(match.group(1))
+    return tuple(found)
+
+
+def next_patch(version):
+    """1.1.0 -> 1.1.1. Refuses anything that is not three plain numbers,
+    because guessing at what comes after 2.0.0rc1 is not this script's job."""
+    parts = version.split(".")
+    if len(parts) != 3 or not all(p.isdigit() for p in parts):
+        raise ValueError(
+            "%r is not a plain major.minor.patch version; bump it by hand" % version
+        )
+    major, minor, patch = parts
+    return "%s.%s.%d" % (major, minor, int(patch) + 1)
+
+
+def bump(pyproject_text, init_text):
+    """Both files' new contents, plus the version they now declare."""
+    current_pyproject, current_init = read_versions(pyproject_text, init_text)
+    if current_pyproject != current_init:
+        raise ValueError(
+            "pyproject.toml says %s but __init__.py says %s; fix that before "
+            "releasing" % (current_pyproject, current_init)
+        )
+    new = next_patch(current_pyproject)
+    return (
+        PYPROJECT_RE.sub('version = "%s"' % new, pyproject_text, count=1),
+        INIT_RE.sub('__version__ = "%s"' % new, init_text, count=1),
+        new,
+    )
+
+
+def main(argv):
+    pyproject_text = PYPROJECT.read_text()
+    init_text = INIT.read_text()
+
+    if "--current" in argv:
+        print(read_versions(pyproject_text, init_text)[0])
+        return 0
+
+    new_pyproject, new_init, new = bump(pyproject_text, init_text)
+    if "--dry-run" not in argv:
+        PYPROJECT.write_text(new_pyproject)
+        INIT.write_text(new_init)
+    print(new)
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main(sys.argv[1:]))
+    except ValueError as exc:
+        print("error: %s" % exc, file=sys.stderr)
+        raise SystemExit(1)

iporigin-1.1.1/tools/sources.py

@@ -0,0 +1,321 @@
+"""Where the address ranges come from.
+
+Every source here is the provider's own published feed, so the dataset is
+reproducible: anyone can re-run tools/build_dataset.py and get the same
+thing. That matters more than coverage — a bundled blob nobody can verify
+is a blob nobody should trust.
+
+A source that fails is skipped with a warning rather than failing the
+build. These are ten third-party endpoints; on any given day one of them
+is having a bad time, and that must not block a release.
+"""
+
+import csv
+import io
+import json
+import re
+import urllib.request
+
+USER_AGENT = "iporigin-dataset-builder/1.0 (+https://github.com/Yuix-Networks/iporigin)"
+TIMEOUT = 60
+
+
+def _get(url):
+    request = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
+    with urllib.request.urlopen(request, timeout=TIMEOUT) as response:
+        return response.read()
+
+
+def _get_json(url):
+    return json.loads(_get(url))
+
+
+def _get_text(url):
+    return _get(url).decode("utf-8", "replace")
+
+
+def aws():
+    data = _get_json("https://ip-ranges.amazonaws.com/ip-ranges.json")
+    for row in data.get("prefixes", []):
+        yield row["ip_prefix"]
+    for row in data.get("ipv6_prefixes", []):
+        yield row["ipv6_prefix"]
+
+
+def gcp():
+    data = _get_json("https://www.gstatic.com/ipranges/cloud.json")
+    for row in data.get("prefixes", []):
+        prefix = row.get("ipv4Prefix") or row.get("ipv6Prefix")
+        if prefix:
+            yield prefix
+
+
+def google():
+    # cloud.json is only the ranges Google Cloud hands to customers.
+    # goog.json is every range Google announces, which is what covers
+    # things like 8.8.8.8 — so both are needed, and they overlap.
+    data = _get_json("https://www.gstatic.com/ipranges/goog.json")
+    for row in data.get("prefixes", []):
+        prefix = row.get("ipv4Prefix") or row.get("ipv6Prefix")
+        if prefix:
+            yield prefix
+
+
+def azure():
+    # Microsoft publishes a dated JSON behind a download page and changes the
+    # filename every week, so the URL has to be discovered rather than pinned.
+    page = _get_text("https://www.microsoft.com/en-us/download/details.aspx?id=56519")
+    match = re.search(
+        r"https://download\.microsoft\.com/download/[^\"']*?ServiceTags_Public_\d+\.json",
+        page,
+    )
+    if not match:
+        raise RuntimeError("could not find the ServiceTags JSON link on the page")
+    data = _get_json(match.group(0))
+    for value in data.get("values", []):
+        for prefix in value.get("properties", {}).get("addressPrefixes", []):
+            yield prefix
+
+
+def digitalocean():
+    text = _get_text("https://www.digitalocean.com/geo/google.csv")
+    for row in csv.reader(io.StringIO(text)):
+        if row and "/" in row[0]:
+            yield row[0]
+
+
+def linode():
+    # RFC 8805 geofeed: "prefix,country,region,city,postcode", # for comments.
+    for line in _get_text("https://geoip.linode.com/").splitlines():
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        prefix = line.split(",")[0].strip()
+        if "/" in prefix:
+            yield prefix
+
+
+def vultr():
+    data = _get_json("https://geofeed.constant.com/?json")
+    for row in data.get("subnets", []):
+        prefix = row.get("ip_prefix")
+        if prefix:
+            yield prefix
+
+
+def oracle():
+    data = _get_json("https://docs.oracle.com/en-us/iaas/tools/public_ip_ranges.json")
+    for region in data.get("regions", []):
+        for cidr in region.get("cidrs", []):
+            prefix = cidr.get("cidr")
+            if prefix:
+                yield prefix
+
+
+def cloudflare():
+    for url in ("https://www.cloudflare.com/ips-v4", "https://www.cloudflare.com/ips-v6"):
+        for line in _get_text(url).splitlines():
+            line = line.strip()
+            if "/" in line:
+                yield line
+
+
+def fastly():
+    data = _get_json("https://api.fastly.com/public-ip-list")
+    for key in ("addresses", "ipv6_addresses"):
+        for prefix in data.get(key, []):
+            yield prefix
+
+
+def github():
+    data = _get_json("https://api.github.com/meta")
+    seen = set()
+    for key, values in data.items():
+        if key in ("verifiable_password_authentication", "ssh_key_fingerprints", "domains"):
+            continue
+        if not isinstance(values, list):
+            continue
+        for prefix in values:
+            if isinstance(prefix, str) and "/" in prefix and prefix not in seen:
+                seen.add(prefix)
+                yield prefix
+
+
+# name -> (kind, fetcher). "kind" is what the range means to a caller:
+# hosting is a machine in a datacenter, cdn is edge infrastructure that
+# fronts other people's sites and says nothing about who the visitor is.
+SOURCES = {
+    "Amazon AWS": ("hosting", aws),
+    "Google Cloud": ("hosting", gcp),
+    "Google": ("hosting", google),
+    "Microsoft Azure": ("hosting", azure),
+    "DigitalOcean": ("hosting", digitalocean),
+    "Linode": ("hosting", linode),
+    "Vultr": ("hosting", vultr),
+    "Oracle Cloud": ("hosting", oracle),
+    "GitHub": ("hosting", github),
+    "Cloudflare": ("cdn", cloudflare),
+    "Fastly": ("cdn", fastly),
+}
+
+
+# ---------------------------------------------------------------------------
+# Community aggregations
+#
+# Some providers publish no machine-readable range feed at all — Hetzner and
+# OVH are the two that matter most, since a large share of abusive traffic
+# comes from them. Consumer VPN exits and crawler ranges have the same
+# problem for a different reason: nobody has an interest in publishing them.
+#
+# These come from two community repos instead. Both are CC0, which is why
+# these two and not the half-dozen others that cover the same ground:
+# redistributing an unlicensed list inside an MIT package is not something a
+# dependency should ask of the people who install it.
+#
+#   rezmoss/cloud-provider-ip-addresses  CC0-1.0
+#   lord-alfred/ipranges                 CC0-1.0
+#
+# They are second-hand by definition, so they are labelled as such in the
+# README rather than presented as the provider's own word.
+# ---------------------------------------------------------------------------
+
+REZMOSS = "https://raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses/main/%s/%s_ips_v%d.txt"
+LORD_ALFRED = "https://raw.githubusercontent.com/lord-alfred/ipranges/main/%s/ipv%d_merged.txt"
+
+
+def _plain_cidr_lines(url, required=True):
+    try:
+        text = _get_text(url)
+    except Exception:
+        if required:
+            raise
+        return
+    for line in text.splitlines():
+        line = line.strip()
+        if line and not line.startswith("#") and "/" in line:
+            yield line
+
+
+def _rezmoss(slug):
+    def fetch():
+        yield from _plain_cidr_lines(REZMOSS % (slug, slug, 4))
+        # Not every provider has a v6 file with content; a missing one must
+        # not lose the v4 ranges we already collected.
+        yield from _plain_cidr_lines(REZMOSS % (slug, slug, 6), required=False)
+
+    return fetch
+
+
+def _lord_alfred(slug):
+    def fetch():
+        yield from _plain_cidr_lines(LORD_ALFRED % (slug, 4))
+        yield from _plain_cidr_lines(LORD_ALFRED % (slug, 6), required=False)
+
+    return fetch
+
+
+COMMUNITY = {
+    # Hosting with no official feed.
+    "Hetzner": ("hosting", _rezmoss("hetzner")),
+    "OVHcloud": ("hosting", _rezmoss("ovhcloud")),
+    "Scaleway": ("hosting", _rezmoss("scaleway")),
+    "Alibaba Cloud": ("hosting", _rezmoss("alibaba")),
+    "Leaseweb": ("hosting", _rezmoss("leaseweb")),
+    "UpCloud": ("hosting", _rezmoss("upcloud")),
+    "IBM Cloud": ("hosting", _rezmoss("ibmcloud")),
+    "Huawei Cloud": ("hosting", _rezmoss("huawei")),
+    "Tencent Cloud": ("hosting", _rezmoss("tencent")),
+    "Rackspace": ("hosting", _rezmoss("rackspace")),
+    # CDN.
+    "Akamai": ("cdn", _rezmoss("akamai")),
+    "Gcore": ("cdn", _rezmoss("gcore")),
+    # Consumer VPN exits — the thing no provider feed can give us.
+    "Mullvad": ("vpn", _rezmoss("mullvad")),
+    "ProtonVPN": ("vpn", _lord_alfred("protonvpn")),
+    "Apple Private Relay": ("vpn", _rezmoss("apple_private_relay")),
+    # Tor is its own thing: not a VPN, not a datacenter, and a caller
+    # usually wants to treat it differently from both.
+    "Tor": ("tor", _rezmoss("tor")),
+    # Declared crawlers. Separate from hosting because "a bot" and "someone
+    # on a server" call for different handling — you rate-limit one and
+    # block the other.
+    "Googlebot": ("bot", _rezmoss("googlebot")),
+    "Bingbot": ("bot", _rezmoss("bingbot")),
+    "GPTBot": ("bot", _rezmoss("gptbot")),
+    "ClaudeBot": ("bot", _rezmoss("claudebot")),
+    "PerplexityBot": ("bot", _rezmoss("perplexitybot")),
+    "DuckDuckBot": ("bot", _rezmoss("duckduckbot")),
+    "Amazonbot": ("bot", _rezmoss("amazonbot")),
+    "Applebot": ("bot", _rezmoss("applebot")),
+    "Common Crawl": ("bot", _rezmoss("commoncrawl")),
+    "Internet Archive": ("bot", _rezmoss("internetarchive")),
+}
+
+SOURCES.update(COMMUNITY)
+
+
+# ---------------------------------------------------------------------------
+# Sources used with the upstream maintainers' permission
+#
+# These repositories carry no licence file, which normally means "all rights
+# reserved" and rules them out of an MIT package. They are included because
+# permission was obtained from each maintainer directly — see NOTICE.
+#
+# Only what is actually additive is taken. Two well-known lists were measured
+# and left out rather than included for the sake of it:
+#
+#   jhassine/server-ip-addresses  52,772 prefixes, 227M addresses, and every
+#                                 one of 211,616 sampled addresses already
+#                                 covered — it is a subset of the provider
+#                                 feeds it was itself built from.
+#   Pymmdrza/Datacenter_List...   1,280 new addresses over what Hetzner's
+#                                 other sources already give.
+#
+# A source that adds nothing is not free: it is another endpoint that can
+# break the weekly rebuild.
+# ---------------------------------------------------------------------------
+
+JJCK = "https://raw.githubusercontent.com/123jjck/cdn-ip-ranges/main/%s/%s_plain_ipv4.txt"
+
+
+def _jjck(slug):
+    # IPv4 only; this repo publishes no v6 files.
+    return lambda: _plain_cidr_lines(JJCK % (slug, slug))
+
+
+def akamai_secops():
+    yield from _plain_cidr_lines(
+        "https://raw.githubusercontent.com/SecOps-Institute/"
+        "Akamai-ASN-and-IPs-List/master/akamai_ip_cidr_blocks.lst"
+    )
+
+
+BY_PERMISSION = {
+    # Networks with no feed anywhere else. Measured additions over the
+    # CC0 tier, largest first.
+    "Cogent": ("hosting", _jjck("cogent")),          # +36.2M addresses
+    "DataCamp": ("cdn", _jjck("datacamp")),          # +1.07M
+    "Contabo": ("hosting", _jjck("contabo")),        # +603k
+    "Vercel": ("hosting", _jjck("vercel")),          # +134k
+    "CDN77": ("cdn", _jjck("cdn77")),                # +128k
+    "GleSYS": ("hosting", _jjck("glesys")),          # +158k
+    "Scalaxy": ("hosting", _jjck("scalaxy")),        # +105k
+    "GTHost": ("hosting", _jjck("gthost")),          # +89k
+    "Melbicom": ("hosting", _jjck("melbicom")),      # +63k
+    "BuyVM": ("hosting", _jjck("buyvm")),            # +32k
+    "BunnyCDN": ("cdn", _jjck("bunny")),             # +4k
+}
+
+# Akamai already has a CC0 source; this one adds ~309k addresses on top, so
+# it feeds the same label rather than creating a second Akamai entry.
+_akamai_cc0 = COMMUNITY["Akamai"][1]
+
+
+def akamai_combined():
+    yield from _akamai_cc0()
+    yield from akamai_secops()
+
+
+COMMUNITY["Akamai"] = ("cdn", akamai_combined)
+
+SOURCES.update(BY_PERMISSION)