Proxy and VPN Detection Dataset

Proxy & VPN intelligence. As exits come online.

Identify proxy and VPN exits with provider, network, and risk context. Receive new observations in real time, with hourly and daily snapshots for historical analysis.

Discuss dataset licensing Explore the dataset

Observed exitsProvider attributionStreams + snapshots

Put a provider
behind the IP.

Match IPs in your traffic logs to proxy providers and network types. Use observation timestamps to check whether an exit was active at the time of an event.

How we collect the data

Your trafficiptimestamp

Infrastructure matchesproxies.parquet

IP / observed atProvider / classification

198.51.100.422026-06-1107:58:12 UTC

GeonodeResidential proxy

203.0.113.182026-06-1107:57:46 UTC

OxylabsResidential proxy

192.0.2.362026-06-1107:56:31 UTC

Bright DataDatacenter proxy

Proxy exits.

Residential, mobile, and datacenter proxy observations, keyed by IP. Match individual addresses to a named provider.

Anonymizer infrastructure.

VPNs, Tor exits, and private relays, represented as address ranges. Connect individual events to the wider network.

Proxy observation fields.

Join records to your traffic logs by IP. Group observations by provider, proxy type, country, or ASN.

Dataset feed

proxies

Fields

ipstring: 198.51.100.42
providerstring: GEONODE
typestring: RESIDENTIAL_PROXY
timestampint64: 1781164692
country_codestring: US
asnuint32: 64500

Real-time Firehose

See proxy exits
as they come online.

Update detections as exits are observed, with the provider, network, and timestamp attached to each event.

FirehoseReal time

Update your rules
as exits change.

Continuous delivery: Individual NDJSON events over HTTP.
Attribution included: IP, provider, type, country, ASN, and timestamp.
VPNs & anonymizers, too: A separate stream covers observed VPN, Tor, and relay ranges.

Connect to the Firehose

Proxy observations

07:58:21198.51.XXX.XXX
IPIDEAResidential
US
07:58:18192.0.XXX.XXX
Bright DataDatacenter
GB
07:58:15203.0.XXX.XXX
OxylabsResidential
DE
07:58:12198.51.XXX.XXX
GeonodeResidential
US

For bulk & historical analysis

Hourly and daily snapshots.

Load compressed Parquet into your warehouse for backfills, joins, and investigations.

Explore snapshot feeds

Hourly

Hour-by-hour observations for the current UTC day.

export/latest

Daily

Consolidated observations for historical analysis.

export/YYYY-MM-DD

Firehose connection and access

Connect to the proxy FirehoseShell

curl --fail --no-buffer \
  "https://api.synthient.com/api/v4/feeds/proxies/stream" \
  -H "x-api-key: $SYNTHIENT_API_KEY"

Use x-api-key with PROXY_FIREHOSE. The anonymizer stream uses ANONYMIZERS_STREAM. Reconnect when the server closes the connection after up to 30 minutes.

Snapshot download and retention

Compressed Parquet · SHA-256 · row counts · schema metadata

Download the latest snapshotShell

curl --fail --location \
  "https://api.synthient.com/api/v4/feeds/proxies/export/latest" \
  -H "x-api-key: $SYNTHIENT_API_KEY" \
  --output proxies.parquet

Hourly files cover the current UTC day. At 00:30 UTC, the previous day’s hourlies become a daily rollup. Use PROXY_FEEDS for proxy exports and ANONYMIZERS_FEED for anonymizer exports.

Evaluate the Proxy & VPN Dataset.

Request sample records and licensing.

Discuss dataset licensing Firehose documentation