Detect residential proxies and anonymized traffic.
Get real-time, high-fidelity data on millions of IPs worldwide. Power your pipelines, SIEM and API with our data.
Enrich behavior, eliminate fraud.
The ultimate flexibility in use-case and performance.
Network
ASN, ISP, organization, and connection type information for any IP address.
Behavior
Deterministic signals for programmatic traffic, web scraping, torrenting, and bot-like patterns.
Proxies and VPNs
Real-time identification of residential proxies, botnets, private relays, and commercial VPNs.
{"ip": "31.59.107.15","network": {"asn": 396356,"isp": "Latitude.sh","type": "DATACENTER","org": "Private Customer","abuse_email": null,"abuse_phone": null,"domain": null},"location": {"country": "CO","state": "DC","city": "Bogotá","timezone": "America/Bogota","longitude": -74.06938,"latitude": 4.71061,"geo_hash": "d2g"},"ip_data": {"device_count": 10,"devices": [{ "os": "Linux", "version": "i386" },{ "os": "iOS", "version": "11.0" }],"behavior": ["TORRENTING","PROGRAMMATIC_TRAFFIC"],"categories": ["RESIDENTIAL_PROXY","COMMERCIAL_VPN"],"ip_risk": 100,"enriched": [{"provider": "IPIDEA","type": "RESIDENTIAL_PROXY","last_seen": "2025-07-06"},{"provider": "NETNUT","type": "RESIDENTIAL_PROXY","last_seen": "2025-09-26"},{"provider": "EXPRESSVPN","type": "COMMERCIAL_VPN","last_seen": "2025-09-03"}]}}
Research
Read our latest insights on fraud prevention, proxy detection, and internet security.
A Broken System Fueling Botnets
Synthient continues to track the Kimwolf DDoS and proxy botnet with this report, delivering significant findings on the inner workings, infection chain, and reliance on the residential proxy ecosystem. Kimwolf has been highly active since early August of 2025, with substantial growth over the past four months. The Synthient’s research team assesses with high confidence that the total number of infected devices has surpassed 2 million, primarily targeting Android devices running an exposed Android Debug Bridge (ADB) service via residential proxies. These findings further reveal an expansive network of compromised TV streaming devices used by providers to obtain large pools of IP addresses.Given Kimwolf's reliance on residential proxies for infections, we advise all proxy providers to block high-risk ports and restrict access to the local network. Users should check whether they are affected by visiting synthient.com/check. Infected TV boxes should be wiped or destroyed. Organizations should block connections to the referenced C2 servers and domains, and monitor network traffic for suspicious activity.Synthient expects to observe a growing interest among threat actors in gaining unrestricted access to proxy networks to infect devices, obtain network access, or access sensitive information. Kimwolf highlights the risks posed by unsecured proxy networks and their viability as an attack vector.
Read story →IPCola: A Tangled Mess
A look into the internals behind a large-scale proxy operation, from the sourcing of IPs to the platform itself. How proxy providers utilize everything from TV boxes to free software for building out a pool of unique proxies.
Read story →Realtime and Bulk Data
Transparent, flat-rate pricing. No surprises.
API
- 10M API Lookups/month
- Limited data attributes
- IPv4 and IPv6 Coverage
API + Feed
- 25M API Lookups/month
- Full Feed Access
- Datacenter & ISP Proxies
- IPv4 and IPv6 Coverage
- 99.99% SLA
API + Feed + Firehose
- 50M API Lookups/month
- Full Feed Access
- Real-time Firehose Stream
- IPv4 and IPv6 Coverage
- 99.99% SLA
* Discounted pricing available for non-profits and government entities.
Full Comparison
| Feature | Context API $7k/yr | Context API + Feed $55k/yr | Context API + Feed + Firehose $85k/yr |
|---|---|---|---|
| Data Coverage | |||
| Commercial & Enterprise VPNs | Included | Included | Included |
| Datacenter proxies | Limited | Included | Included |
| ISP Proxies | Limited | Included | Included |
| Residential Proxies | Limited | Included | Included |
| Infected IP Addresses | Limited | Included | Included |
| Other callback proxies | Limited | Included | Included |
| IPv4 and IPv6 Coverage | Included | Included | Included |
| Technical Specs | |||
| API Lookups | 10M/month | 20M/month | 20M/month |
| Feed Access | - | Included | Included |
| Realtime Firehose | - | - | Included |
| Avg uncompressed size | N/A | 20GB | 20GB+ |
| 99.99% SLA | Included | Included | Included |
| Licensing | |||
| Licensing Rights | - | - | By Quote |
Frequently asked questions
We take a custom approach for mapping proxy pools that achieves an entirely different level of coverage compared to competitors in this space. Every indicator we report has 100% confidence, with support for IPv4 and IPv6 proxies.
We offer a pilot period for enterprise users so they can evaluate the quality. Please contact us for more information.
We store lookup results for 90 days. Historical data is available to customers on the feeds portion of the API.
Commercial use is allowed as long as raw data is not exposed. If you are interested in exposing raw data please reach out.
The Firehose is a real-time stream of events designed for immediate ingestion into security systems. The Feed provides hourly snapshots of our entire dataset, suitable for batch processing and analysis.
Support is offered through Slack, email, and phone. This is provided during business hours for non-enterprise customers.
Check if your platform is targeted by residential proxies
Free scan • No account required
