Synthient
Contact

Detection Data For The Modern Web.

Track and block millions of malicious entities. Create complex rules and policies to integrate Synthient into your existing systems and workflows.

Try the dataGet in touch

Overview

All services healthy · 186 lookups · 35.4M unique IPs · 1.1B proxy events today

Lookup success
98.92%
186 lookups
Proxy events
1.1B
4%
Unique proxies
35.4M
2%
Team members
2
Enterprise plan
Active providers
98
of 793 tracked
Activity

Lookups over time

api/v4 · successful lookups

Lookups
100,147

Tracking 600+ VPN and Proxy Services

Attackers move fast in the real-world. Synthient moves faster.
01

Lookup API: identify an IP or domain.

Send one IP or domain and get ASN, ISP, country, network type, proxy provider, behavior tags, and a 0-100 risk score.

Lookup API
  • IPv4 and IPv6 lookup
  • Provider attribution
  • Behavior arrays
  • Batch enrichment
View Lookup API
Lookup Response
23-28
21"intelligence": {
22"risk_score": 96,
23"behavior": ["PROGRAMMATIC_TRAFFIC"],
24"categories": ["RESIDENTIAL_PROXY"],
25"devices": [
26{ "os": "Linux", "version": "i386" },
27{ "os": "iOS", "version": "11.0" }
28],
29"providers": [
30{
31"provider": "LUNAPROXY",
32"type": "RESIDENTIAL_PROXY",
33"last_seen": 1776729600
34},
35{
36"provider": "BRIGHTDATA",
37"type": "RESIDENTIAL_PROXY",
38"last_seen": 1777248000
39}
02

Feeds: proxy and VPN data as Parquet files.

Download hourly and daily snapshots of proxy, VPN, relay, crawler, and anonymizer data. Load them into a warehouse, notebook, or review workflow.

Feed datasets
  • Hourly and Daily snapshots
  • Historical Partitions
  • Developer Friendly
  • Parquet Support

Feeds

Feeds

8 of 10 datasets unlockedlatest hourly snapshot 7m agohistorical partitions available

Datasets10 datasets

Proxies

GET /api/v4/feeds/proxies/export/latest
scope active
kindsnapshotrowssizecreatedartifact

Exports expose id, checksum, row_count, size_bytes, and download_path, the same fields as /api/v4/feeds/proxies/export.

Export activity

last 24h
proxies hourly snapshot completed · 08:00 UTCanonymizers historical backfill ready · Jun 10
03

Firehose: Stream Online Proxies and VPNs.

Stream residential proxies, VPNs, relays, and anonymizers as they come online. Send the live NDJSON feed to fraud, auth, SIEM, or Kafka systems.

Firehose
  • Second precision
  • Thousands of events/s
  • Realtime detections
  • Fraud, auth, and SIEM routing
View Firehose workflow
MONITORING
Alertslive
Residential
risk 96%72.184.x.xroute
Residential
risk 97%91.232.x.xroute
Clean
clean 3%104.16.x.xallow
04

Helios: Attribute with confidence.

Helios records HTTP, TLS, DNS, and ADB traffic hitting Synthient honeypots, then connects each capture to the source IP, proxy provider, and target.

Helios evidence
  • Botnet traffic capture
  • Targeted domains and paths
  • HTTP, TLS, DNS, and ADB captures
  • Exit IPs
View Helios
Botnet traffic live
google.comTARGETED
One pivot

Helios captures live botnet traffic as it moves through a real proxy path.
PLANS

Plans by data surface.

01

Researcher

$20Kper year

Use the Lookup API for IP and domain checks with provider, network, country, behavior, and risk fields refreshed daily.

API lookups
4M/month
Precision
Daily granularity
Best fit
Research and daily checks
Delivery
Lookup API responses
Surfaces
Lookup API
Feeds
Firehose
Helios
Purchase
02

Startup

$65Kper year

Download proxy, VPN, relay, and crawler data as Parquet feed snapshots with minute-level refreshes.

API lookups
6M/month
Precision
Minute granularity
Best fit
Seed teams and warehouses
Delivery
API plus feed snapshots
Surfaces
Lookup API
Feeds
Firehose
Helios
Purchase
03

Business

$85Kper year

Subscribe to Firehose events and send new proxy observations to fraud, auth, abuse, or SIEM systems within seconds.

API lookups
8M/month
Precision
Second granularity
Best fit
Production detections
Delivery
API, feeds, and stream
Surfaces
Lookup API
Feeds
Firehose
Helios
Get in touch
04

Enterprise

Get in touch

Add Helios honeypot captures, custom scopes, security review, and direct support for your deployment.

API lookups
Custom
Precision
Custom precision
Best fit
Enterprise programs
Delivery
All surfaces and Helios
Surfaces
Lookup API
Feeds
Firehose
Helios
Purchase
FAQ

Direct answers.

Need specifics on access, pricing, or fit? Reach the team directly.

Email uscontact@synthient.comSchedule a call30 min
  • Q1

    Do you offer free trials?

    Yes. We offer scoped evaluations for qualified teams so you can test lookup responses, feed samples, and integration fit before a commercial rollout.

  • Q2

    Can I make historical lookups?

    Yes. Historical analysis is available through retained feed snapshots and plan-scoped data access. The Lookup API is optimized for current enrichment, while Feeds are built for backfills and warehouse joins.

  • Q3

    Are there any commercial restrictions to the data?

    Commercial use is governed by your signed agreement. Internal fraud, abuse, access, and security workflows are supported; resale, redistribution, or public mirroring requires explicit permission.

  • Q4

    What is the difference between Proxy Feeds and the Proxy Firehose?

    Proxy Feeds are Parquet files for warehouse jobs, backfills, and audits. Proxy Firehose is a live NDJSON stream for new observations that need to update block, challenge, or review rules quickly.

  • Q5

    What kind of support do you offer?

    We help with onboarding, schema mapping, API and CLI integration, feed delivery, Firehose filters, and production rollout questions. Enterprise plans can include deeper review and dedicated support paths.
free scanno account required

Check a domain for proxy traffic.

Enter a domain to see recent requests, source IPs, proxy providers, ports, and subdomains in a public sample report.