> ## Documentation Index
> Fetch the complete documentation index at: https://vpn-docs.wxapros.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Real-time and bulk IP intelligence for VPN, proxy, Tor, datacenter, CDN, and residential proxy detection.

WXA VPN Intelligence identifies IP addresses operating as anonymizers — VPN
endpoints, proxy servers (datacenter, residential, mobile), Tor relays,
hosting infrastructure, content delivery networks. Use it to detect fraud,
block credential-stuffing traffic, enforce licensing jurisdictions, screen
sanctions, and enrich threat intelligence pipelines.

## Two ways to use

<CardGroup cols={2}>
  <Card title="Real-time API" icon="bolt" href="/quickstart">
    Look up a single IP, batch up to 100 IPs, or query aggregate statistics.
    Sub-100ms p50, JSON, REST.
  </Card>

  <Card title="Bulk data feeds" icon="database" href="/guides/bulk-export">
    Daily-refreshed full datasets in CSV, MMDB, or Parquet. Drop into
    your warehouse or threat-intel pipeline.
  </Card>
</CardGroup>

## What we detect

| Category            | What it means                                                      |
| ------------------- | ------------------------------------------------------------------ |
| `vpn`               | Commercial VPN endpoints (Mullvad, NordVPN, Proton, etc.)          |
| `proxy`             | Generic proxy servers, datacenter and residential                  |
| `residential_proxy` | Provider-attributed exit IPs (BrightData, IPRoyal, Decodo, etc.)   |
| `tor`               | Public Tor exit relays                                             |
| `hosting`           | Datacenter / cloud-provider IP ranges (AWS, GCP, Azure, OVH, etc.) |
| `cdn`               | CDN edge IPs (Cloudflare, Fastly, Akamai, etc.)                    |
| `relay`             | Apple Private Relay, similar privacy-preserving relays             |
| `clean`             | None of the above — known consumer IP                              |

Each classification carries a `confidence` score `[0, 1]`, a `provider` name
where applicable, an `asn` and `asn_org`, and an `observation_count`
indicating how many independent signals fed the label.

## How it works

Three independent collection methods feed one classification engine:

* **Active scanning** of the public IPv4 address space on VPN/proxy ports,
  with application-layer fingerprinting to confirm protocol identity
* **Honeypot observation** of routed proxy traffic across a network of
  WXA-controlled endpoints
* **Network telemetry** from opted-in WXA/Attaxion customers, used to
  derive protocol-level VPN signals invisible to scanning alone

The detection methodology is described in detail at
[docs/detection-methods.md](https://github.com/whois-api-llc/wxa_vpn/blob/main/docs/detection-methods.md)
and the full data-collection disclosure is at
[docs/legal/data-collection-disclosure.md](https://github.com/whois-api-llc/wxa_vpn/blob/main/docs/legal/data-collection-disclosure.md).

## Get started

<Steps>
  <Step title="Sign up">
    Create a free account at [wxaintel.wxapros.com/signup](https://wxaintel.wxapros.com/signup).
    Free tier is 10,000 lookups/month with no card.
  </Step>

  <Step title="Get an API key">
    From your dashboard, generate a key for VPN Intelligence.
  </Step>

  <Step title="Make your first call">
    See the [Quickstart](/quickstart).
  </Step>
</Steps>