WXA VPN Intelligence identifies IP addresses operating as anonymizers — VPN endpoints, proxy servers (datacenter, residential, mobile), Tor relays, hosting infrastructure, content delivery networks. Use it to detect fraud, block credential-stuffing traffic, enforce licensing jurisdictions, screen sanctions, and enrich threat intelligence pipelines.Documentation Index
Fetch the complete documentation index at: https://vpn-docs.wxapros.com/llms.txt
Use this file to discover all available pages before exploring further.
Two ways to use
Real-time API
Look up a single IP, batch up to 100 IPs, or query aggregate statistics.
Sub-100ms p50, JSON, REST.
Bulk data feeds
Daily-refreshed full datasets in CSV, MMDB, or Parquet. Drop into
your warehouse or threat-intel pipeline.
What we detect
| Category | What it means |
|---|---|
vpn | Commercial VPN endpoints (Mullvad, NordVPN, Proton, etc.) |
proxy | Generic proxy servers, datacenter and residential |
residential_proxy | Provider-attributed exit IPs (BrightData, IPRoyal, Decodo, etc.) |
tor | Public Tor exit relays |
hosting | Datacenter / cloud-provider IP ranges (AWS, GCP, Azure, OVH, etc.) |
cdn | CDN edge IPs (Cloudflare, Fastly, Akamai, etc.) |
relay | Apple Private Relay, similar privacy-preserving relays |
clean | None of the above — known consumer IP |
confidence score [0, 1], a provider name
where applicable, an asn and asn_org, and an observation_count
indicating how many independent signals fed the label.
How it works
Three independent collection methods feed one classification engine:- Active scanning of the public IPv4 address space on VPN/proxy ports, with application-layer fingerprinting to confirm protocol identity
- Honeypot observation of routed proxy traffic across a network of WXA-controlled endpoints
- Network telemetry from opted-in WXA/Attaxion customers, used to derive protocol-level VPN signals invisible to scanning alone
Get started
Sign up
Create a free account at wxaintel.wxapros.com/signup.
Free tier is 10,000 lookups/month with no card.
Make your first call
See the Quickstart.