VPN & Proxy Detection API

Multi-layered detection — beyond what scan-only APIs deliver

• Public-data aggregation

  ASN, WHOIS, and ownership records correlated across all five regional internet registries to baseline every routed network.

• Active port scanning

  Continuous internet-wide port and protocol fingerprinting identifies VPN appliances, OpenVPN listeners, WireGuard, and SOCKS exits that public data alone misses.

• Residential proxy enumeration

  We observe residential-proxy exit IPs and attribute each to its operating network, re-enumerated continuously — the signal scan-based methods structurally miss.

• Network-telemetry corroboration

  Proprietary network-telemetry signals corroborate residential and mobile proxy IPs that look like normal traffic and stay invisible to active scans.

Frequently asked questions

What is a VPN and proxy detection API?

It is an API that takes an IP address and tells you whether it belongs to a VPN, proxy, Tor exit, or hosting provider, along with provider attribution, recency, a risk score and a confidence value. You can use it for real-time proxy detection at signup, checkout, or any decision point.

How is this different from other VPN-detection APIs?

Most stop at public ASN data. We observe residential-proxy exit IPs directly and attribute each to its operating network, with NetFlow corroboration — surfacing residential and mobile proxies that scan-based methods miss.

How fresh is the data?

The data is refreshed continuously. Residential proxy IPs churn rapidly — roughly 90% of any pool rotates within 6 days — so we re-enumerate hourly on the high-churn tiers. Bulk exports are regenerated daily.

Does the API cover IPv6?

The API covers IPv4 today. IPv6 coverage is on the roadmap.

Can I get bulk data without the API?

Yes. CSV exports are included from the Pro plan, and full MMDB and Parquet exports are included on Business plans, via /api/v1/export/{csv,mmdb,parquet}. MMDB files drop into existing MMDB-compatible toolchains.

How do I check whether an IP is anonymous?

Send the IP to the lookup endpoint. If it is an anonymous IP behind a VPN, proxy, or Tor exit, the response flags the type and returns the supporting evidence.

Can we start with the API and move to databases or feeds later?

Yes. Start with the real-time API, then migrate to bulk databases or feeds as volumes grow, with the same consistent formats throughout.

Can I combine this with other WhoisXML API data?

Yes. Pair it with IP Geolocation API, IP Netblocks API, and Threat Intelligence API to add location, network-ownership and threat context from one provider.