// detect with confidence

Proxy Detection For The Modern Web.

Track and block millions of malicious entities. Create complex rules and policies to integrate Synthient into your existing systems and workflows.

Get in touch Explore the data

Real-time Context API

Bulk Feeds

Real-time Firehose

Tracking the Leading VPN and Proxy Providers

Enrich behavior, eliminate fraud.

The ultimate flexibility in use-case and performance.

{  "ip": "31.59.107.15",
  "network": {
    "asn": 396356,
    "isp": "Latitude.sh",
    "type": "DATACENTER",
    "org": "Private Customer",
    "abuse_email": "[email protected]",
    "abuse_phone": null,
    "domain": "latitude.sh"
  },
  "location": {
    "country": "CO",
    "state": "DC",
    "city": "Bogotá",
    "timezone": "America/Bogota",
    "longitude": -74.06938,
    "latitude": 4.71061,
    "geo_hash": "d2g"
  },
  "ip_data": {
    "device_count": 10,
    "devices": [
      { "os": "Linux", "version": "i386" },
      { "os": "iOS", "version": "11.0" }
    ],
    "behavior": [
      "TORRENTING",
      "PROGRAMMATIC_TRAFFIC"
    ],
    "categories": [
      "RESIDENTIAL_PROXY",
      "COMMERCIAL_VPN"
    ],
    "ip_risk": 100,
    "enriched": [
      {
        "provider": "IPIDEA",
        "type": "RESIDENTIAL_PROXY",
        "last_seen": "2025-07-06"
      },
      {
        "provider": "NETNUT",
        "type": "RESIDENTIAL_PROXY",
        "last_seen": "2025-09-26"
      },
      {
        "provider": "EXPRESSVPN",
        "type": "COMMERCIAL_VPN",
        "last_seen": "2025-09-03"
      }
    ]
  }
}

Realtime and Bulk Data

Transparent, flat-rate pricing. No surprises.

YearlyMonthly

Analyst

$7k/yr

API access for targeted lookups and integration.

10M API Lookups/month
Limited data attributes
IPv4 and IPv6 Coverage

Get in touch

Featured

API + Proxy Feeds + Firehose

Request a Quote

Everything in Proxy Feeds plus real-time streaming via the Proxy Firehose.

20M API Lookups/month
Full Proxy Feeds Access
Real-time Proxy Firehose Stream
IPv4 and IPv6 Coverage
99.99% SLA

Get in touch

API + Proxy Feeds

Request a Quote

Comprehensive coverage of anonymity networks.

15M API Lookups/month
Full Proxy Feeds Access
Datacenter & ISP Proxies
IPv4 and IPv6 Coverage
99.99% SLA

Get in touch

* Discounted pricing available for non-profits and government entities.

Full Comparison

YearlyMonthly

Comparison of Synthient pricing plans and features
Feature	Context API $7k/yr$750/mo	Context API + Proxy Feeds Request a QuoteRequest a Quote	Context API + Proxy Feeds + Firehose Request a QuoteRequest a Quote
Data Coverage
Commercial & Enterprise VPNs	Included	Included	Included
Datacenter proxies	Limited	Included	Included
ISP Proxies	Limited	Included	Included
Residential Proxies	Limited	Included	Included
Infected IP Addresses	Limited	Included	Included
Other callback proxies	Limited	Included	Included
IPv4 and IPv6 Coverage	Included	Included	Included
Technical Specs
API Lookups	10M/month	20M/month	20M/month
Proxy Feeds Access	-	Included	Included
Realtime Proxy Firehose	-	-	Included
Avg uncompressed size	N/A	20GB	20GB+
99.99% SLA	Included	Included	Included
Licensing
Licensing Rights	-	-	By Quote

Data Coverage

Commercial & Enterprise VPNs

Context API: Included
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

Datacenter proxies

Context API: Limited
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

ISP Proxies

Context API: Limited
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

Residential Proxies

Context API: Limited
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

Infected IP Addresses

Context API: Limited
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

Other callback proxies

Context API: Limited
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

IPv4 and IPv6 Coverage

Context API: Included
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

Technical Specs

API Lookups

Context API: 10M/month
Context API + Proxy Feeds: 20M/month
Context API + Proxy Feeds + Firehose: 20M/month

Proxy Feeds Access

Context API: -
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

Realtime Proxy Firehose

Context API: -
Context API + Proxy Feeds: -
Context API + Proxy Feeds + Firehose: Included

Avg uncompressed size

Context API: N/A
Context API + Proxy Feeds: 20GB
Context API + Proxy Feeds + Firehose: 20GB+

99.99% SLA

Context API: Included
Context API + Proxy Feeds: Included
Context API + Proxy Feeds + Firehose: Included

Licensing

Licensing Rights

Context API: -
Context API + Proxy Feeds: -
Context API + Proxy Feeds + Firehose: By Quote

Frequently asked questions

We take a custom approach for mapping proxy pools that achieves an entirely different level of coverage compared to competitors in this space. Every indicator we report has 100% confidence, with support for IPv4 and IPv6 proxies.

We offer a pilot period for enterprise users so they can evaluate the quality. Please contact us for more information.

We store lookup results for 90 days. Historical data is available to customers on the feeds portion of the API.

Commercial use is allowed as long as raw data is not exposed. If you are interested in exposing raw data please reach out.

The Proxy Firehose is a real-time stream of events designed for immediate ingestion into security systems. The Proxy Feeds provide hourly snapshots of our entire dataset, suitable for batch processing and analysis.

Support is offered through Slack, email, and phone. This is provided during business hours for non-enterprise customers.

Check if your platform is targeted by residential proxies

Free scan • No account required

{

"ip": "31.59.107.15",

"network": {

"asn": 396356,

"isp": "Latitude.sh",

"type": "DATACENTER",

"org": "Private Customer",

"abuse_email": "[email protected]",

"abuse_phone": null,

"domain": "latitude.sh"

"location": {

"country": "CO",

"state": "DC",

"city": "Bogotá",

"timezone": "America/Bogota",

"longitude": -74.06938,

"latitude": 4.71061,

"geo_hash": "d2g"

"ip_data": {

"device_count": 10,

"devices": [

{ "os": "Linux", "version": "i386" },

{ "os": "iOS", "version": "11.0" }

"behavior": [

"TORRENTING",

"PROGRAMMATIC_TRAFFIC"

"categories": [

"RESIDENTIAL_PROXY",

"COMMERCIAL_VPN"

"ip_risk": 100,

"enriched": [

{

"provider": "IPIDEA",

"type": "RESIDENTIAL_PROXY",

"last_seen": "2025-07-06"

{

"provider": "NETNUT",

"type": "RESIDENTIAL_PROXY",

"last_seen": "2025-09-26"

{

"provider": "EXPRESSVPN",

"type": "COMMERCIAL_VPN",

"last_seen": "2025-09-03"

}

]

}

}

Research

Read our latest insights on fraud prevention, proxy detection, and internet security.

Malware

ProxyBox: Socks5Systemz Lives On

Synthient’s Research Team continuously tracks Black Hat proxy services due to the significant risks they pose to clients in the financial sector. Recently, a service known as “ProxyBox” stood out after online discussions revealed its overwhelming popularity among threat actors for carding, credential stuffing, and identity theft. This report builds upon earlier research by the Bitsights Research Team, detailing the evolution of this threat from its origins as "Socks5Systemz." Originally sold on underground hacking forums since 2013, the Socks5Systemz malware saw widespread commercial use under the banner of PROXY[.]AM. Following that platform's shutdown, the service rebranded as ProxyBox and continued to provide clients with access to 32,000 to 35,0000 daily active IPs (DAI).

Read story →

Malware

A Broken System Fueling Botnets

Synthient continues to track the Kimwolf DDoS and proxy botnet with this report, delivering significant findings on the inner workings, infection chain, and reliance on the residential proxy ecosystem. Kimwolf has been highly active since early August of 2025, with substantial growth over the past four months. The Synthient’s research team assesses with high confidence that the total number of infected devices has surpassed 2 million, primarily targeting Android devices running an exposed Android Debug Bridge (ADB) service via residential proxies. These findings further reveal an expansive network of compromised TV streaming devices used by providers to obtain large pools of IP addresses.Given Kimwolf's reliance on residential proxies for infections, we advise all proxy providers to block high-risk ports and restrict access to the local network. Users should check whether they are affected by visiting synthient.com/check. Infected TV boxes should be wiped or destroyed. Organizations should block connections to the referenced C2 servers and domains, and monitor network traffic for suspicious activity.Synthient expects to observe a growing interest among threat actors in gaining unrestricted access to proxy networks to infect devices, obtain network access, or access sensitive information. Kimwolf highlights the risks posed by unsecured proxy networks and their viability as an attack vector.

Read story →

Realtime and Bulk Data

Transparent, flat-rate pricing. No surprises.

YearlyMonthly

Analyst

$7k/yr

API access for targeted lookups and integration.

10M API Lookups/month
Limited data attributes
IPv4 and IPv6 Coverage

Get in touch

Featured

API + Proxy Feeds + Firehose

Request a Quote

Everything in Proxy Feeds plus real-time streaming via the Proxy Firehose.

20M API Lookups/month
Full Proxy Feeds Access
Real-time Proxy Firehose Stream
IPv4 and IPv6 Coverage
99.99% SLA

Get in touch

API + Proxy Feeds

Request a Quote

Comprehensive coverage of anonymity networks.

15M API Lookups/month
Full Proxy Feeds Access
Datacenter & ISP Proxies
IPv4 and IPv6 Coverage
99.99% SLA

Get in touch

Comparison of Synthient pricing plans and features
Feature	Context API $7k/yr$750/mo	Context API + Proxy Feeds Request a QuoteRequest a Quote	Context API + Proxy Feeds + Firehose Request a QuoteRequest a Quote
Data Coverage
Commercial & Enterprise VPNs	Included	Included	Included
Datacenter proxies	Limited	Included	Included
ISP Proxies	Limited	Included	Included
Residential Proxies	Limited	Included	Included
Infected IP Addresses	Limited	Included	Included
Other callback proxies	Limited	Included	Included
IPv4 and IPv6 Coverage	Included	Included	Included
Technical Specs
API Lookups	10M/month	20M/month	20M/month
Proxy Feeds Access	-	Included	Included
Realtime Proxy Firehose	-	-	Included
Avg uncompressed size	N/A	20GB	20GB+
99.99% SLA	Included	Included	Included
Licensing
Licensing Rights	-	-	By Quote

Feature

Context API
$7k/yr

Context API + Proxy Feeds
Request a Quote

Context API + Proxy Feeds + Firehose
Request a Quote

Data Coverage

Commercial & Enterprise VPNs

Included

Datacenter proxies

Limited

Included

ISP Proxies

Limited

Included

Residential Proxies

Limited

Included

Infected IP Addresses

Limited

Included

Other callback proxies

Limited

Included

IPv4 and IPv6 Coverage

Included

Technical Specs

API Lookups

10M/month

20M/month

Proxy Feeds Access

Included

Realtime Proxy Firehose

Included

Avg uncompressed size

N/A

20GB

20GB+

99.99% SLA

Included

Licensing

Licensing Rights

By Quote

Frequently asked questions

We offer a pilot period for enterprise users so they can evaluate the quality. Please contact us for more information.

We store lookup results for 90 days. Historical data is available to customers on the feeds portion of the API.

Commercial use is allowed as long as raw data is not exposed. If you are interested in exposing raw data please reach out.

Support is offered through Slack, email, and phone. This is provided during business hours for non-enterprise customers.

Research

Read our latest insights on fraud prevention, proxy detection, and internet security.

Malware

ProxyBox: Socks5Systemz Lives On

Read story →

Malware

A Broken System Fueling Botnets

Read story →

Proxy Detection For The Modern Web.

Enrich behavior, eliminate fraud.

Network

Behavior

Proxies and VPNs

Realtime and Bulk Data

Analyst

API + Proxy Feeds + Firehose

API + Proxy Feeds

Full Comparison

Frequently asked questions

Check if your platform is targeted by residential proxies

Proxy Detection For The Modern Web.

Enrich behavior, eliminate fraud.

Network

Behavior

Proxies and VPNs

Research

ProxyBox: Socks5Systemz Lives On

A Broken System Fueling Botnets

Realtime and Bulk Data

Analyst

API + Proxy Feeds + Firehose

API + Proxy Feeds

Full Comparison

Frequently asked questions

Check if your platform is targeted by residential proxies

Research

ProxyBox: Socks5Systemz Lives On

A Broken System Fueling Botnets