Detection methodology
What the proxy and VPN test checks.
Synthient evaluates an IP address or domain against continuously updated observations of residential proxy networks, mobile proxy pools, commercial VPN exits, datacenter proxies, Tor relays, hosting networks, crawlers, and infrastructure associated with automated abuse. Results combine network ownership, provider attribution, observed behavior, and recency instead of relying on an ASN or hosting label alone.
Residential and mobile addresses need special treatment because the same address can be used by a household, carrier-grade NAT, or a proxy customer at different times. Synthient records the provider, network type, last-seen time, and supporting signals so risk teams can make a decision using current context rather than permanently treating every consumer IP as hostile.
How to interpret a result.
Network classification
Identifies residential, mobile, ISP, datacenter, VPN, Tor, relay, crawler, or cloud infrastructure when the available evidence supports that label.
Provider attribution
Connects an address to an observed proxy or VPN provider and, where researched, its operator, resellers, SDK sourcing, and related infrastructure.
Risk score
A 0–100 score summarizes current evidence for prioritization. It is a decision input, not proof that a person or organization acted maliciously.
Observation time
Last-seen timestamps help distinguish active infrastructure from historical evidence. Recheck an address before blocking it or escalating an investigation.
Use the signal in context.
A positive match is most useful alongside account history, device evidence, request velocity, authentication outcomes, and the action being attempted. Teams commonly use the data to add friction to suspicious signups, protect promotions, review credential-stuffing attempts, prioritize abuse queues, and enrich investigations. Avoid treating a proxy match as a standalone reason to accuse a user or block an entire consumer network.