Comparison
| Free | Starter | Pro | Scale | Business | Enterprise | |
|---|---|---|---|---|---|---|
| Monthly quota | 10 K | 1 M | 10 M | 50 M | Unlimited¹ | Unlimited¹ |
| Rate limit | 2/min | 30/min | 100/min | 250/min | 500/min | 10,000/min |
Boolean flags + risk score (is_vpn, is_proxy, …) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| ASN enrichment + abuse score | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| VPN provider / operator name | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| Batch lookup (≤100 IPs/call) | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| Residential proxy attribution (provider name) | — | — | ✓ | ✓ | ✓ | ✓ |
| Confidence + freshness signals | — | — | ✓ | ✓ | ✓ | ✓ |
| Full ASN abuse breakdown | — | — | ✓ | ✓ | ✓ | ✓ |
| CSV bulk export | — | — | ✓ | ✓ | ✓ | ✓ |
| Higher rate limits + overage metering | — | — | — | ✓ | ✓ | ✓ |
| MMDB bulk download | — | — | — | — | ✓ | ✓ |
| Parquet bulk download + residential /32 | — | — | — | — | ✓ | ✓ |
| NetFlow protocol attribution (premium VPN signal) | — | — | — | — | — | ✓ |
| SVU / RAI shadow-VPN intel | — | — | — | — | — | ✓ |
| SLA | None | 99.9 % | 99.9 % | 99.9 % | 99.9 % + contractual | 99.95 % |
| Support | Community | Priority | Priority | Dedicated | Dedicated + AM |
What changes between tiers
Free → Starter
You get the provider / operator name for VPN classifications and the batch endpoint (up to 100 IPs/call). Free tier returnsprovider: null
even for known VPN endpoints.
Starter → Pro
You get residential proxy attribution — which commercial proxy network (BrightData, IPRoyal, Decodo, etc.) the exit IP belongs to — plus confidence + freshness signals, the full ASN abuse breakdown, and CSV bulk export. This is what most fraud and abuse pipelines need.Pro → Scale
Same field surface as Pro at higher volume — 50 M lookups/month, higher rate limits, and per-lookup overage metering for high-throughput workloads.Scale → Business
You get the downloadable bulk feeds: MMDB (MaxMind-compatible) and Parquet (warehouse loads), plus residential /32 enumeration. Bulk data is redistribution-licensed and sales-fulfilled.Business → Enterprise
You get NetFlow protocol attribution — the protocol family that the VPN endpoint speaks (OpenVPN, WireGuard, IKEv2, anyconnect, custom- camouflaged TLS, etc.), derived from network telemetry. This is the moat field — invisible to scanning alone. Also unlocks shadow-VPN intel (public-internet-facing remote access infrastructure with attribution), the highest-value field for cyber-insurance and incident-response use cases.Choosing a tier
Build / evaluate
Free or Starter. Free is enough for prototyping; Starter adds provider
names and batch lookups.
Production fraud
Pro is the sweet spot for most apps — residential proxy attribution and
confidence signals are the fields most fraud teams need.
High-volume platforms
Scale — the same fields as Pro at 50 M lookups/month with overage
metering.
Bulk data / intel
Business for downloadable MMDB + Parquet feeds; Enterprise for NetFlow
protocol attribution and shadow-VPN intel.
Pricing
See wxaintel.wxapros.com/pricing for current dollar amounts. Annual contracts available on request fromsales@whoisxmlapi.com.