vpndetection-flask 1.0.0__tar.gz

vpndetection_flask-1.0.0/.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.11', '3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - run: pip install -e ".[dev]"
+      - run: ruff check .
+      - run: ruff format --check .
+      - run: mypy src
+      - run: pytest

vpndetection_flask-1.0.0/.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # PyPI trusted publishing exchanges this OIDC token for a short-lived upload
+      # token. No API token in a repository secret.
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      # The tag only TRIGGERS this; PyPI publishes whatever the built artifact says.
+      # Without this check, tagging v1.0.1 against a 1.0.0 package silently
+      # republishes 1.0.0, or fails as "already exists" with a confusing message.
+      - name: Tag must match the package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg="$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' src/vpndetection_flask/__init__.py)"
+          if [ "$tag" != "$pkg" ] ; then
+            echo "tag $tag does not match __version__ $pkg" >&2
+            exit 1
+          fi
+      - run: pip install -e ".[dev]" build
+      - run: pytest
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1

vpndetection_flask-1.0.0/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.py[cod]
+
+# Build output.
+build/
+dist/
+*.egg-info/
+
+# Virtualenvs, including any made to run codegen. Keep them out of the tree entirely.
+.venv/
+venv/
+.venv-*/
+
+# Tool caches.
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/

vpndetection_flask-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mslm Dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vpndetection_flask-1.0.0/PKG-INFO

@@ -0,0 +1,150 @@
+Metadata-Version: 2.5
+Name: vpndetection-flask
+Version: 1.0.0
+Summary: Official Flask extension for the VPNDetection API. Detect VPNs, proxies, Tor, hosting and CDN visitors on every request.
+Project-URL: Homepage, https://vpndetection.io
+Project-URL: Source, https://github.com/vpndetection-io/sdk-python-flask
+Author-email: Mslm Dev <support@vpndetection.io>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: fraud-prevention,ip-intelligence,middleware,proxy-detection,tor,vpn,vpn-detection
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: flask>=3.0
+Requires-Dist: vpndetection<4,>=2.1.0
+Provides-Extra: dev
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# [<img src="https://s3.vpndetection.io/vpndetection-public/brand/mark.svg" alt="VPNDetection" width="24"/>](https://vpndetection.io/) VPNDetection Flask Extension
+
+[![PyPI](https://img.shields.io/pypi/v/vpndetection-flask.svg)](https://pypi.org/project/vpndetection-flask/)
+[![license](https://img.shields.io/pypi/l/vpndetection-flask.svg)](LICENSE)
+
+The official Flask Extension for the [VPNDetection](https://vpndetection.io) API.
+
+It classifies the visitor behind each request — VPN, residential proxy, Tor, hosting, CDN, relay — and hands the answer to your code. Blocking is opt-in.
+
+## Getting Started
+
+```bash
+pip install vpndetection-flask
+```
+
+Requires Python 3.11 or newer.
+
+You need an API key. Create one in the [console](https://app.vpndetection.io); the free tier's allowance is counted per source address, and a server is a single source address, so a key is what makes this usable in production rather than optional.
+
+```python
+from flask import Flask
+from vpndetection_flask import VPNDetection
+
+app = Flask(__name__)
+VPNDetection(app, api_key=os.environ["VPNDETECTION_API_KEY"])
+```
+
+`init_app(app)` is supported for the application-factory pattern.
+
+```python
+from vpndetection_flask import lookup
+
+
+@app.route("/")
+def index():
+    found = lookup()
+    return "Hello, VPN user" if found.result.is_vpn else "Hello"
+```
+
+By default nothing is blocked. Every request gets an answer and your own code decides what that means — which is usually what you want, because whether a VPN visitor is a problem depends entirely on what they are doing.
+
+## Blocking
+
+Pass a `block_condition` and a matching request is answered with `403` and never reaches your code.
+
+```python
+block_condition = {"is_vpn": True}
+```
+
+A condition is written in the shape of a result, keyed by the same names the API uses, and only the members you name are considered. That lets it reach the evidence, not just the flags:
+
+```python
+{"is_vpn": True, "vpn": {"provider": "nordvpn"}}  # one provider
+{"is_resproxy": True, "resproxy": {"hits": {"gte": 5}}}  # a numeric threshold
+{"vpn": {"confidence": ["high", "medium"]}}  # any of these
+[{"is_tor": True}, {"is_resproxy": True}]  # a list is OR
+```
+
+Values are matched by equality, strings without regard to case. A list means any-of. A dict of `gte`/`gt`/`lte`/`lt` compares numbers, and every bound you give must hold, so two of them are a range. Members set to `False` or `None` are ignored, so a condition states the signals you act on; one that constrains nothing would match every request, and is refused when the middleware is built rather than silently blocking all your traffic.
+
+Replace the refusal with `on_blocked`.
+
+## Where the client address comes from
+
+This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
+
+By default the extension uses `request.remote_addr`, which is the socket peer unless you have wrapped the app in werkzeug's `ProxyFix`. Behind a load balancer without it, every visitor looks like the load balancer — a datacenter address, so a hosting rule would block all of them. Adding `ProxyFix` is Flask's own answer and everything else here follows from it.
+
+For an edge that writes the address into its own header, name the header:
+
+```python
+from python_flask import header_ip_selector
+
+ip_selector = header_ip_selector("CF-Connecting-IP")  # or True-Client-IP, or your own
+```
+
+`xff_ip_selector()` reads `X-Forwarded-For` directly. Be aware that the left-most entry is whatever the caller sent, because proxies append to that header — it is only trustworthy when an edge you control overwrites it. If you know how many proxies sit in front, count from the right instead: `xff_ip_selector(1)` is the address your nearest proxy saw.
+
+Anything else, pass your own callable. It receives the request and returns an address.
+
+If the address resolves to a private one, the middleware says so once through the `vpndetection` logger. That is expected on localhost and is the signal to fix your configuration anywhere else.
+
+## When a lookup fails
+
+The request is let through, and the reason is recorded on the answer's `error`. Our outage should not become yours, so a network failure, an exhausted quota or a rejected key all fail open. Pass `fail_closed=True` to block instead. Private addresses are answered locally and never fail, so this will not lock you out in development.
+
+## Cost and latency
+
+Answers are cached for an hour, so a returning visitor costs nothing, and private addresses never leave the process. A cache miss is one request to our API, bounded at 2.5 seconds by default and not retried — on a request path, failing open quickly beats holding a visitor while we try again. Both are adjustable, as is the cache, through a `vpndetection` client you build yourself and pass as `client`.
+
+Skip what you do not care about:
+
+```python
+skip = lambda request: request.path.startswith("/static")
+```
+
+Beyond a few million distinct visitors a day, stop calling the API per request: [download the dataset](https://vpndetection.io/databases) and look addresses up locally instead.
+
+## Absent is not false
+
+Only `ip` and `is_vpn` come back on every plan. A field your plan does not include is `None`, which means "not in your plan" rather than "checked, and no".
+
+```python
+lookup().result.is_hosting  # None when your plan does not include it
+```
+
+A `block_condition` naming a member your plan does not serve can never match, so the middleware warns once instead of failing silently. Pass `on_missing_field="raise"` to make it an error.
+
+## Other Libraries
+
+There are official VPNDetection client libraries available for many languages including PHP, Python, Go, Java, Ruby, and many popular frameworks such as Django, Rails, and Laravel. See our GitHub at https://github.com/vpndetection-io for more.
+
+## About VPNDetection
+
+VPN Detection API: Accurate anonymity detection identifying VPNs, residential proxies, hosting servers, Tor nodes, CDNs, relays and more.
+
+[<img src="https://s3.vpndetection.io/vpndetection-public/brand/mark.svg" alt="VPNDetection" width="96"/>](https://vpndetection.io/)
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).

vpndetection_flask-1.0.0/README.md

@@ -0,0 +1,121 @@
+# [<img src="https://s3.vpndetection.io/vpndetection-public/brand/mark.svg" alt="VPNDetection" width="24"/>](https://vpndetection.io/) VPNDetection Flask Extension
+
+[![PyPI](https://img.shields.io/pypi/v/vpndetection-flask.svg)](https://pypi.org/project/vpndetection-flask/)
+[![license](https://img.shields.io/pypi/l/vpndetection-flask.svg)](LICENSE)
+
+The official Flask Extension for the [VPNDetection](https://vpndetection.io) API.
+
+It classifies the visitor behind each request — VPN, residential proxy, Tor, hosting, CDN, relay — and hands the answer to your code. Blocking is opt-in.
+
+## Getting Started
+
+```bash
+pip install vpndetection-flask
+```
+
+Requires Python 3.11 or newer.
+
+You need an API key. Create one in the [console](https://app.vpndetection.io); the free tier's allowance is counted per source address, and a server is a single source address, so a key is what makes this usable in production rather than optional.
+
+```python
+from flask import Flask
+from vpndetection_flask import VPNDetection
+
+app = Flask(__name__)
+VPNDetection(app, api_key=os.environ["VPNDETECTION_API_KEY"])
+```
+
+`init_app(app)` is supported for the application-factory pattern.
+
+```python
+from vpndetection_flask import lookup
+
+
+@app.route("/")
+def index():
+    found = lookup()
+    return "Hello, VPN user" if found.result.is_vpn else "Hello"
+```
+
+By default nothing is blocked. Every request gets an answer and your own code decides what that means — which is usually what you want, because whether a VPN visitor is a problem depends entirely on what they are doing.
+
+## Blocking
+
+Pass a `block_condition` and a matching request is answered with `403` and never reaches your code.
+
+```python
+block_condition = {"is_vpn": True}
+```
+
+A condition is written in the shape of a result, keyed by the same names the API uses, and only the members you name are considered. That lets it reach the evidence, not just the flags:
+
+```python
+{"is_vpn": True, "vpn": {"provider": "nordvpn"}}  # one provider
+{"is_resproxy": True, "resproxy": {"hits": {"gte": 5}}}  # a numeric threshold
+{"vpn": {"confidence": ["high", "medium"]}}  # any of these
+[{"is_tor": True}, {"is_resproxy": True}]  # a list is OR
+```
+
+Values are matched by equality, strings without regard to case. A list means any-of. A dict of `gte`/`gt`/`lte`/`lt` compares numbers, and every bound you give must hold, so two of them are a range. Members set to `False` or `None` are ignored, so a condition states the signals you act on; one that constrains nothing would match every request, and is refused when the middleware is built rather than silently blocking all your traffic.
+
+Replace the refusal with `on_blocked`.
+
+## Where the client address comes from
+
+This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
+
+By default the extension uses `request.remote_addr`, which is the socket peer unless you have wrapped the app in werkzeug's `ProxyFix`. Behind a load balancer without it, every visitor looks like the load balancer — a datacenter address, so a hosting rule would block all of them. Adding `ProxyFix` is Flask's own answer and everything else here follows from it.
+
+For an edge that writes the address into its own header, name the header:
+
+```python
+from python_flask import header_ip_selector
+
+ip_selector = header_ip_selector("CF-Connecting-IP")  # or True-Client-IP, or your own
+```
+
+`xff_ip_selector()` reads `X-Forwarded-For` directly. Be aware that the left-most entry is whatever the caller sent, because proxies append to that header — it is only trustworthy when an edge you control overwrites it. If you know how many proxies sit in front, count from the right instead: `xff_ip_selector(1)` is the address your nearest proxy saw.
+
+Anything else, pass your own callable. It receives the request and returns an address.
+
+If the address resolves to a private one, the middleware says so once through the `vpndetection` logger. That is expected on localhost and is the signal to fix your configuration anywhere else.
+
+## When a lookup fails
+
+The request is let through, and the reason is recorded on the answer's `error`. Our outage should not become yours, so a network failure, an exhausted quota or a rejected key all fail open. Pass `fail_closed=True` to block instead. Private addresses are answered locally and never fail, so this will not lock you out in development.
+
+## Cost and latency
+
+Answers are cached for an hour, so a returning visitor costs nothing, and private addresses never leave the process. A cache miss is one request to our API, bounded at 2.5 seconds by default and not retried — on a request path, failing open quickly beats holding a visitor while we try again. Both are adjustable, as is the cache, through a `vpndetection` client you build yourself and pass as `client`.
+
+Skip what you do not care about:
+
+```python
+skip = lambda request: request.path.startswith("/static")
+```
+
+Beyond a few million distinct visitors a day, stop calling the API per request: [download the dataset](https://vpndetection.io/databases) and look addresses up locally instead.
+
+## Absent is not false
+
+Only `ip` and `is_vpn` come back on every plan. A field your plan does not include is `None`, which means "not in your plan" rather than "checked, and no".
+
+```python
+lookup().result.is_hosting  # None when your plan does not include it
+```
+
+A `block_condition` naming a member your plan does not serve can never match, so the middleware warns once instead of failing silently. Pass `on_missing_field="raise"` to make it an error.
+
+## Other Libraries
+
+There are official VPNDetection client libraries available for many languages including PHP, Python, Go, Java, Ruby, and many popular frameworks such as Django, Rails, and Laravel. See our GitHub at https://github.com/vpndetection-io for more.
+
+## About VPNDetection
+
+VPN Detection API: Accurate anonymity detection identifying VPNs, residential proxies, hosting servers, Tor nodes, CDNs, relays and more.
+
+[<img src="https://s3.vpndetection.io/vpndetection-public/brand/mark.svg" alt="VPNDetection" width="96"/>](https://vpndetection.io/)
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).

vpndetection_flask-1.0.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "vpndetection-flask"
+dynamic = ["version"]
+description = "Official Flask extension for the VPNDetection API. Detect VPNs, proxies, Tor, hosting and CDN visitors on every request."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+authors = [{ name = "Mslm Dev", email = "support@vpndetection.io" }]
+keywords = ["vpn", "vpn-detection", "proxy-detection", "tor", "ip-intelligence", "fraud-prevention", "middleware"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Internet",
+    "Topic :: Security",
+    "Typing :: Typed",
+]
+dependencies = ["vpndetection>=2.1.0,<4", "flask>=3.0"]
+
+[project.urls]
+Homepage = "https://vpndetection.io"
+Source = "https://github.com/vpndetection-io/sdk-python-flask"
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "mypy>=1.11", "ruff>=0.6"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/vpndetection_flask"]
+
+[tool.hatch.version]
+path = "src/vpndetection_flask/__init__.py"
+
+[tool.ruff]
+line-length = 96
+
+[tool.mypy]
+python_version = "3.11"
+strict = true

vpndetection_flask-1.0.0/src/vpndetection_flask/__init__.py

@@ -0,0 +1,123 @@
+"""Official Flask extension for the VPNDetection API.
+
+Classifies the visitor behind each request and hangs the answer off ``g.vpndetection``,
+where your views can read it. Blocking is opt-in.
+
+    from flask import Flask
+    from vpndetection_flask import VPNDetection
+
+    app = Flask(__name__)
+    VPNDetection(app, api_key=os.environ["VPNDETECTION_API_KEY"])
+
+The framework-agnostic half lives in ``vpndetection.middleware``; this package is only
+the parts that are genuinely Flask-shaped.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from typing import Any
+
+from flask import Flask, Response, g, jsonify, request
+from vpndetection.middleware import (
+    Core,
+    IpSelector,
+    Lookup,
+    Options,
+    RequestView,
+    Selectors,
+    bind_selectors,
+)
+from werkzeug.wrappers import Request as WerkzeugRequest
+
+__all__ = [
+    "VPNDetection",
+    "default_ip_selector",
+    "header_ip_selector",
+    "lookup",
+    "xff_ip_selector",
+]
+
+__version__ = "1.0.0"
+
+_SELECTORS: Selectors[WerkzeugRequest] = bind_selectors(
+    lambda req: RequestView(
+        header=lambda name: req.headers.get(name),
+        framework_ip=lambda: req.remote_addr,
+    )
+)
+
+#: ``request.remote_addr``, which is the socket peer unless you have wrapped the app in
+#: werkzeug's ``ProxyFix``.
+#:
+#: Behind a load balancer without it, every visitor looks like the load balancer - a
+#: datacenter address a hosting rule would block them all for. If you are behind one,
+#: add ``ProxyFix`` (Flask's own answer) or use :func:`header_ip_selector`.
+default_ip_selector: IpSelector[WerkzeugRequest] = _SELECTORS.default
+
+#: An address from ``X-Forwarded-For``.
+#:
+#: The LEFT-MOST entry (``depth`` 0) is whatever the caller sent, because proxies
+#: append to this header. It is only trustworthy when an edge you control overwrites
+#: it. When you know how many proxies sit in front, count from the right:
+#: ``xff_ip_selector(1)`` is the address your nearest proxy saw.
+xff_ip_selector = _SELECTORS.xff
+
+#: An address from a single-value header your edge writes -
+#: ``header_ip_selector("CF-Connecting-IP")`` behind Cloudflare. Falls back to
+#: ``remote_addr`` when the header is absent.
+header_ip_selector = _SELECTORS.header
+
+
+def lookup() -> Lookup | None:
+    """What the extension found out about this visitor.
+
+    None when the extension has not run for this request, or when ``skip`` claimed it.
+    """
+    return getattr(g, "vpndetection", None)
+
+
+class VPNDetection:
+    """Classify the visitor, and optionally refuse the request.
+
+    Takes everything :class:`vpndetection.middleware.Options` does, plus ``on_blocked``.
+
+    Without a ``block_condition`` this only enriches the request and never refuses one,
+    leaving the decision to your own views. A lookup that fails - network, quota, an
+    outage of ours - lets the request through and records why on ``lookup().error``,
+    unless you set ``fail_closed``.
+    """
+
+    def __init__(
+        self,
+        app: Flask | None = None,
+        *,
+        on_blocked: Callable[[Lookup], Response] | None = None,
+        **options: Any,
+    ) -> None:
+        self._on_blocked = on_blocked or _refuse
+        self._core: Core[WerkzeugRequest] = Core(Options(**options), default_ip_selector)
+        if app is not None:
+            self.init_app(app)
+
+    def init_app(self, app: Flask) -> None:
+        """Register on an app, for the factory pattern."""
+        app.extensions.setdefault("vpndetection", self)
+        app.before_request(self._before_request)
+
+    def _before_request(self) -> Response | None:
+        found = self._core.evaluate(request)
+        if found is None:
+            return None
+        g.vpndetection = found
+        if found.blocked:
+            # Returning a response from before_request is what STOPS the view from
+            # running; merely building one would let the request through.
+            return self._on_blocked(found)
+        return None
+
+
+def _refuse(_lookup: Lookup) -> Response:
+    response = jsonify({"error": "access denied"})
+    response.status_code = 403
+    return response

vpndetection_flask-1.0.0/testdata/bogons.json

@@ -0,0 +1,60 @@
+{
+  "v4": [
+    "0.0.0.0/8",
+    "10.0.0.0/8",
+    "100.64.0.0/10",
+    "127.0.0.0/8",
+    "169.254.0.0/16",
+    "172.16.0.0/12",
+    "192.0.0.0/24",
+    "192.0.2.0/24",
+    "192.168.0.0/16",
+    "198.18.0.0/15",
+    "198.51.100.0/24",
+    "203.0.113.0/24",
+    "224.0.0.0/4",
+    "240.0.0.0/4",
+    "255.255.255.255/32"
+  ],
+  "v6": [
+    "::/128",
+    "::1/128",
+    "::ffff:0:0/96",
+    "::/96",
+    "100::/64",
+    "2001:10::/28",
+    "2001:db8::/32",
+    "fc00::/7",
+    "fe80::/10",
+    "fec0::/10",
+    "ff00::/8",
+    "2002::/24",
+    "2002:a00::/24",
+    "2002:7f00::/24",
+    "2002:a9fe::/32",
+    "2002:ac10::/28",
+    "2002:c000::/40",
+    "2002:c000:200::/40",
+    "2002:c0a8::/32",
+    "2002:c612::/31",
+    "2002:c633:6400::/40",
+    "2002:cb00:7100::/40",
+    "2002:e000::/20",
+    "2002:f000::/20",
+    "2002:ffff:ffff::/48",
+    "2001::/40",
+    "2001:0:a00::/40",
+    "2001:0:7f00::/40",
+    "2001:0:a9fe::/48",
+    "2001:0:ac10::/44",
+    "2001:0:c000::/56",
+    "2001:0:c000:200::/56",
+    "2001:0:c0a8::/48",
+    "2001:0:c612::/47",
+    "2001:0:c633:6400::/56",
+    "2001:0:cb00:7100::/56",
+    "2001:0:e000::/36",
+    "2001:0:f000::/36",
+    "2001:0:ffff:ffff::/64"
+  ]
+}