NordVPN Server IP List
I reported an unauthorized vulnerability scan that originated from one of NordVPN’s servers in the Netherlands. After getting redirected to three (3) different departments, I learned that they are unable to do anything regarding abuse unless the abuser basically self-incriminates themselves... and even then, they have the “right to suspend or terminate the account”, but it doesn’t mean that they will actually do anything.
They asked me for "my IPs" that were being impacted so that they could add them to their blacklist. Â This approach seemed backwards. I pointed out that the Tor Project responsibly publishes an exit list of all Tor Nodes and inquired as to whether they could publish a similar list? They simply replied "no".
Not a problem... I can provide this service if they can’t or won't.  All of their VPN IPs are publicly disseminated via DNS, so it's only a matter of resolving their advertised hostnames to IPs.
Now that I have a list of their non-TOS-enforceable VPN endpoints, I can selectively block any types of services and/or requests that I want. Â Within less than 24 hours of blocking their IPs, I've already stopped abuse from from one of their US VPNs targeting different hostnames on two different days.
Here’s the list of current NordVPN Server IPs:
https://gist.github.com/JamoCA/eedaf4f7cce1cb0aeb5c1039af35f0b7
