Two ways to use
Lookup API
Look up a single IP, batch up to 100 IPs, or query aggregate statistics.
JSON, REST.
Bulk data feeds
Files rebuilt daily: the network-range table as CSV, zstd CSV or NDJSON
from Pro; MMDB, Parquet and the residential points table from Business.
Load them into your warehouse or threat-intel pipeline.
What we detect
Each classification carries a
confidence score [0, 1] (Pro+), a provider
name where applicable (Starter+; Pro+ for a residential proxy’s network), an
asn and asn_org, the registered network block (netblock, netname,
netblock_org; Starter+), and an observation_count (Pro+): the number of
times we observed this exact IP as a residential proxy exit over the trailing 90
days (an address not seen in that window keeps its last count), or 0 when the
label comes from a listed network. Most fields above a key’s plan come back as
null; a few are left out instead (see
Response shape and Tiers).
How it works
Four detection layers feed one classification engine:- Public-data baseline: ASN and registry (RIR WHOIS) ownership records
- Active port and protocol fingerprinting, internet-wide, of VPN appliances, OpenVPN, WireGuard and SOCKS exits
- Residential-proxy exit observation, with attribution to the operating network on the enumerated subset
- Network-telemetry corroboration of VPN endpoints
Get started
1
Sign up
Create an account at
vpn-proxy-detection.whoisxmlapi.com/api/signup. The
Intro plan is $1/month for 10,000 lookups/month.
2
Get an API key
From your dashboard, generate a key for the VPN & Proxy Detection API.
3
Make your first call
See the Quickstart.