Mullvad VPN IP Ranges

Known IP ranges

The blocks below are the major address allocations associated with Mullvad VPN. A network of this size deaggregates heavily, so an individual route in the global routing table is usually more specific than the block shown. Prefix sets change over time — use WHOIS Lookup for the authoritative current record for any specific IP.

193.138.216.0/22
193.32.127.0/24
185.213.154.0/24
45.83.222.0/23
193.234.92.0/24
45.132.193.0/24

What does a Mullvad VPN IP mean in a privacy test?

Seeing a Mullvad IP (AS39351) as your exit confirms your VPN traffic exits through Mullvad own network infrastructure. This is the expected result when using Mullvad and confirms your VPN is routing correctly.

Mullvad publishes every exit address it operates

Mullvad's server list is a public JSON endpoint at https://api.mullvad.net/www/relays/all/, and it is unusually complete for a VPN. Each relay is one object carrying hostname, country_code, city_code, ipv4_addr_in, ipv6_addr_in, active and type, plus two fields most providers do not publish at all: owned, which says whether the machine is Mullvad's own hardware, and provider, which names the data centre company when it is not.

That is what makes an exit address checkable rather than merely asserted. An address you are given while connected can be searched for in that file, and the entry it matches names the city, the protocol and whether the box is rented — owned false alongside a provider name is a machine in someone else's data centre. It is also why AS39351 is a small network by prefix count next to the hosting providers on this site: it carries relays, not general customer compute.

What matching a Mullvad address shows, and what it does not

An exit address that appears in the relay list and looks up as AS39351 shows that your traffic is leaving through a Mullvad relay. That is the whole of what it shows. It is not a statement about your DNS queries, which are measured separately and can take a different path; it is not a statement about WebRTC, which can offer a local address alongside the tunnel; and it says nothing about what the tunnel encrypts or about what a site already knows from your browser.

The reverse case — a Mullvad address in someone else's server logs — has an equally narrow answer. A relay is shared by whoever is connected to it at the time, so the address identifies the relay and not a user. And because the relay list is public, an AS39351 address is among the easier VPN addresses for a site to recognise as a VPN: a match confirms the tunnel is carrying your traffic, not that the connection looks like an ordinary one.

Related tools

Frequently asked questions