Skip to main content
WXA VPN Intelligence identifies IP addresses operating as anonymizers — VPN endpoints, proxy servers (datacenter, residential, mobile), Tor relays, hosting infrastructure, content delivery networks. Use it to detect fraud, block credential-stuffing traffic, enforce licensing jurisdictions, screen sanctions, and enrich threat intelligence pipelines.

​
Two ways to use

Real-time API

Look up a single IP, batch up to 100 IPs, or query aggregate statistics. Sub-100ms p50, JSON, REST.

Bulk data feeds

Daily-refreshed full datasets in CSV, MMDB, or Parquet. Drop into your warehouse or threat-intel pipeline.

​
What we detect

Each classification carries a confidence score [0, 1], a provider name where applicable, an asn and asn_org, and an observation_count indicating how many independent signals fed the label.

​
How it works

Three independent collection methods feed one classification engine:
  • Active scanning of the public IPv4 address space on VPN/proxy ports, with application-layer fingerprinting to confirm protocol identity
  • Honeypot observation of routed proxy traffic across a network of WXA-controlled endpoints
  • Network telemetry from opted-in WXA/Attaxion customers, used to derive protocol-level VPN signals invisible to scanning alone
The detection methodology is described in detail at docs/detection-methods.md and the full data-collection disclosure is at docs/legal/data-collection-disclosure.md.

​
Get started

1

Sign up

Create an account at wxaintel.wxapros.com/signup. The Intro plan is $1/month for 10,000 lookups/month.
2

Get an API key

From your dashboard, generate a key for VPN Intelligence.
3

Make your first call

See the Quickstart.