Comparison
¹ Business and Enterprise are unlimited subject to fair use; sustained patterns
at extreme volume are renegotiated to ensure availability for other customers.
WhoisXML API’s Terms of Service
apply (§26.1): no minimum uptime is guaranteed without a separate written
agreement.
What changes between tiers
Intro → Starter
You get the provider / operator name for VPN classifications and the batch endpoint (up to 100 IPs/call). Intro tier returnsprovider: null
even for known VPN endpoints.
Starter → Pro
You get residential proxy attribution — the name of the network operating the exit IP, on the enumerated subset — plus confidence + freshness signals, the full ASN abuse breakdown, CSV bulk export and the coverage report. The coverage report (GET /api/v1/coverage/report) covers the lookups made
with your API key in the last 30 days. matched counts the lookups that
returned a classification other than unknown or suspected_vpn, hosting and
CDN included, so coverage_pct is the share of your lookups that got a
category label, not a detection rate.
Below Pro these fields are still in every response, with null values:
provider on a residential-proxy classification, and the confidence +
freshness signals confidence, first_seen, last_seen,
observation_count, hits_days_pct, providers_num, confidence_decay
and freshness_class. (metadata.raw_score and metadata.signals are
null, and the NetFlow reason codes are left out of reasons[], on every
tier.)
risk_score and the is_* flags are on every tier.
Fields populated by evidence class
From Pro, which of these fields carry a value depends on what produced the classification. A per-IP observation is an exit IP that our residential-proxy enumeration saw directly. A network range is a listed, scanned or NetFlow-derived CIDR, a /32 included. When neither matches, the answer comes from the ASN (hosting) or is unknown. Zscaler’s, Netskope’s and Cisco
Umbrella’s secure web gateways are the exception: an address on a network one of
them runs itself, which no range or observation matches, is unknown with a
risk_score of 0, not hosting, because these networks carry many companies’
employee traffic. An address with its own range or observation keeps that label
and score, and the cap on residential proxy hits covers only the gateways’
published egress addresses (see
Residential proxy hits in the lookups
guide). Other networks keep their usual answer, including other gateways’
networks and the cloud networks some gateways also use.
network is on every tier. On a range result, 0 means the winning label is
range-level and carries no per-IP count, not “not seen lately”: the range
itself can be current. An IP we also observed directly still returns the
range result when the range’s label outranks the observation, for example
tor or relay. Range results keep 0 rather than null on purpose, so a
rule such as providers_num >= 2 matches only results whose winning label is
a per-IP observation.
Pro → Scale
Same field surface as Pro at higher volume — 15 M lookups/month and a higher rate limit.Scale → Business
You get the downloadable bulk feeds: MMDB (two files:wxa_vpn-points.mmdb for residential points and wxa_vpn.mmdb for ranges;
look up points first) and Parquet (warehouse loads), plus residential /32
enumeration. Bulk data is sales-fulfilled.
You also get point-in-time lookups: add as_of=YYYY-MM-DD to a single-IP
lookup for our answer on a past day, from a daily archive kept since
2026-07-31. See point-in-time lookups.
Business → Enterprise
You get NetFlow protocol attribution:observed_location.netflow_protocol,
one of openvpn, wireguard, ikev2, pptp or l2tp. The label is inferred
from the ports seen in network telemetry for the IP (1194, 51820, 500 and 4500,
1723 and 1701), so treat it as an indication rather than a confirmed protocol.
It is returned only when one protocol’s ports clearly dominate that traffic,
and left out otherwise. Also unlocks
shadow-VPN intel (public-internet-facing remote access infrastructure with
attribution), the highest-value field for cyber-insurance and incident-response
use cases.
Choosing a tier
Build / evaluate
Intro or Starter. Intro is enough for prototyping; Starter adds provider
names and batch lookups.
Production fraud
Pro adds residential proxy attribution and confidence signals.
High-volume platforms
Scale — the same fields as Pro at 15 M lookups/month, with a higher rate limit.
Bulk data / intel
Business for downloadable MMDB + Parquet feeds; Enterprise for NetFlow
protocol attribution and shadow-VPN intel.
Pricing
See the pricing page for current dollar amounts. Need annual billing? Contact sales atsales@whoisxmlapi.com.