> ## Documentation Index
> Fetch the complete documentation index at: https://vpn-docs.wxapros.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Lookups

> Single, batch, and high-volume lookup patterns.

## Single IP

The most common pattern: classify one IP at a time.

```python theme={null}
import httpx, os
resp = httpx.get(
    f"https://wxaintel.wxapros.com/api/v1/vpn/ip/{ip}",
    headers={"X-API-Key": os.environ["WXA_API_KEY"]},
)
data = resp.json()
if data["classification"] in ("vpn", "proxy", "residential_proxy"):
    block_signup(data)
```

`is_vpn`, `is_proxy`, `is_residential_proxy`, `is_tor`, `is_hosting`,
`is_cdn`, `is_relay` are the boolean fields most fraud pipelines use.

## Batch

For lists of IPs (Starter tier and above), batch endpoint cuts latency
dramatically:

```python theme={null}
resp = httpx.post(
    "https://wxaintel.wxapros.com/api/v1/vpn/ip/batch",
    headers={"X-API-Key": key, "Content-Type": "application/json"},
    json={"ips": ["1.1.1.1", "8.8.8.8", "192.0.2.1"]},
    timeout=30,
)
results = resp.json()["results"]
```

Up to 100 IPs per request. Each result has the same shape as the single-IP
endpoint. Order matches input.

## High-volume

If you're checking >1 M IPs/day, **don't** use the API one-at-a-time —
use the [bulk export](/guides/bulk-export) for nightly mirroring and
hit local storage.

If real-time is required at scale, use the [MMDB download](/api-reference/export-mmdb):
sub-millisecond local lookups with no rate limits, refreshed hourly on
your side via cron. The trade-off is lag (your mirror is at most an
hour stale).

## What to do with `unknown`

`classification: "unknown"` means we have no high-confidence label for
this IP. Don't treat unknown as either clean or suspicious — treat it as
"no data." Common in:

* Brand new ranges (recently allocated by a RIR)
* Sparse cellular ranges with infrequent observations
* Ranges deliberately excluded from our scanning (per opt-out requests)

Most production callers fall through `unknown` to their next signal
(behavioral, device, payment risk).