Lookup API
IP intelligence. One API request.
Identify proxy providers, VPNs, and botnet infrastructure behind an IP or domain. Get observed behavior, device signatures, and a risk score for your fraud and abuse checks.
Infrastructure intelligenceTracking adversary
Tracking adversary
infrastructure.
Of all types.
Identify ISP and datacenter proxy providers, VPN services, and botnet networks across IPv4 and IPv6.
Explore the response schemaOne request. Connected context.
Resolve an IP or domain to network, location, behavior, and provider intelligence. Batch up to 1,000 addresses.
Name the infrastructure.
Move from an address to its proxy provider, ASN, organization, and network type.
See observed behavior.
Connect an address to observed activity and behavioral signals, with the timestamps behind them.
Prioritize the right signals.
Use a 0–100 risk score alongside the underlying evidence to inform your fraud and abuse checks.
The response,
field by field.
Provider names, device observations, risk scores, and last-seen timestamps. Query one address or batch up to 1,000.
200 OK · application/jsonJSON record
{
"ip": "101.53.218.152",
"network": {
"asn": 55850,
"isp": "Mercury NZ Limited",
"type": "RESIDENTIAL",
"org": "Mercury NZ Limited",
"domain": "mercury.co.nz",
"abuse_email": "abuse-alerts@as55850.net",
"abuse_phone": "+000000000"
},
"location": {
"country": "NZ",
"state": "CAN",
"city": "Christchurch",
"timezone": "Pacific/Auckland",
"latitude": -43.532,
"longitude": 172.341,
"geo_hash": "rb6"
},
"intelligence": {
"risk_score": 96,
"behavior": ["PROGRAMMATIC_TRAFFIC"],
"categories": ["RESIDENTIAL_PROXY"],
"devices": [
{
"os": "ANDROID",
"version": "14",
"last_seen": 1777248000
},
{
"os": "WINDOWS",
"version": "11",
"last_seen": 1776729600
}
],
"providers": [
{
"provider": "LUNAPROXY",
"type": "RESIDENTIAL_PROXY",
"last_seen": 1776729600
},
{
"provider": "BRIGHTDATA",
"type": "RESIDENTIAL_PROXY",
"last_seen": 1777248000
}
]
}
}
Response field reference
network
Who owns and operates the address.
- asn int
- Autonomous system number routing the address
- isp string
- Network operator name
- type string
- RESIDENTIAL, MOBILE, DATACENTER, CORPORATE, and more
- org / domain string | null
- Registered organization and reverse DNS domain
- abuse_email / abuse_phone string | null
- Published abuse contacts when available
location
Where the address resolves.
- country / state / city string
- Resolved geography for the address
- timezone string
- IANA timezone identifier
- latitude / longitude number
- Approximate coordinates
- geo_hash string
- Geohash bucket for coarse joins
intelligence
What Synthient has observed.
- risk_score int 0-100
- Score derived from observed behavior
- behavior string[]
- Observed behavior signals
- categories string[]
- Network classifications such as RESIDENTIAL_PROXY
- devices object[]
- Device OS fingerprints with last_seen
- providers object[]
- Proxy and VPN provider attribution with last_seen
The Synthient differenceGo beyond
Go beyond
a proxy flag.
Identify who operates the exit, what activity was observed, and when it was last seen.
| Capability | Generic provider IP data + proxy flag | Synthient IP intelligence with evidence |
|---|---|---|
| Detection method | Low-confidence NetFlowProxy use inferred from traffic patterns | High-confidence indexingDirect observations of proxy infrastructure |
| Network identity | Residential · USASN, ISP & geolocation | Residential · USASN, ISP & geolocation |
| Provider attribution | proxy: trueNo named operator |  Geonode Oxylabs |
| Behavior & risk | No behavior detail | Programmatic traffic87/100 Observed behavior alongside risk |
| Infrastructure coverage | Public reputation listsKnown, publicly listed services | Public + private networksISP proxies, datacenter proxies, VPNs & botnets |
| IPv6 visibility | IPv4-first coverageLimited visibility into IPv6 proxy networks | IPv4 + IPv6 intelligenceActive IPv6 proxy mapping alongside network signals |
| Device observations | No device context | Android 14Windows 11 OS, version & last seen |
| Observation time | No observation timestamps | Per-provider & per-device timestamps |
Try an IP lookup.
See the providers and risk signals associated with an IP address.