Synthient tracked providers
Includes reseller brands. Some tags require restricted access.
Synthient vs Spur
Synthient vs Spur. Identify providers and resellers.
Synthient tracks 2,500+ providers, including reseller brands. Get the services observed on an IP, their proxy types, and when each was last seen. Available through the API, Parquet feeds, and Firehose.
Why choose Synthient
Coverage and delivery.
Synthient offers provider and reseller attribution, hourly Parquet exports, and an NDJSON stream. Spur offers Context API, JSON feeds, and Monocle for browser-session assessment.
Spur public service tags
Unique tags counted September 28: 934 VPN, 329 proxy, and 35 other tags.
Synthient Researcher lookups / month
Daily granularity. Hourly feeds and Firehose are separate plans.
Synthient vs Spur
API and data comparison.
Response fields, delivery formats, and access requirements.
| Capability | Synthient Infrastructure intelligence | SpurDocumented offering |
|---|---|---|
| IP lookup | GET /api/v4/lookup/ip/{ip_address}. x-api-key authentication. IPv4 and IPv6 supported. | GET /v2/context/{ip}. Token authentication. Returns as, infrastructure, client, risks, and tunnels when available. |
| Provider attribution | intelligence.providers[] returns multiple service and reseller tags, each with provider, type, and last_seen. | tunnels[] returns operator, type, and anonymous. client.proxies lists observed proxy services. |
| Bulk delivery | Hourly Parquet snapshots and daily rollups, with checksums and schema metadata. | Daily gzip-compressed JSON feeds and Realtime files with five-minute observation windows. |
| Freshness and streams | NDJSON over HTTP. 15-second heartbeats and a 30-minute connection limit; no guaranteed replay window. | Realtime files cover five-minute windows, deduplicated by IP. Updates can omit fields present in the daily feed. |
| Network and proxy types | network.type identifies the underlying network. intelligence.categories and providers[].type identify observed proxy or VPN use. | infrastructure identifies network infrastructure. tunnels and client add anonymizer and activity observations. |
| Device observations | devices[] returns observed operating systems and last_seen in Unix seconds. These are IP-associated observations, not the current visitor’s device. | client describes activity associated with the IP. Monocle provides a separate browser-session assessment. |
Provider counts are not accuracy benchmarks. Features and freshness depend on the plan.
Using the data
Investigate the proxy supply chain.
An IP can appear under several service brands. Synthient’s lookup identifies observed services; research profiles explain their upstream and reseller relationships.
Resellers, not just upstreams
Our Bright Data research identifies TorchProxies, LemonClub, and OculusProxies as resellers. The profile shows that supply relationship; an IP lookup shows which services were observed on a particular address.
Proxy observations in Parquet
Download the proxies and anonymizers streams as hourly snapshots or daily rollups. Each export includes a SHA-256 checksum, row count, and schema for warehouse ingestion.
A live observation stream
Firehose delivers observations as NDJSON over HTTP. Use the stream for incoming observations and Parquet snapshots for bulk analysis. Feed and Firehose access are separate from Researcher lookups.
Before you decideQuestions,
Questions,
answered.
Does an empty provider list mean an IP is safe?
No. It means Synthient has no provider observation in that response. Coverage gaps and address rotation can produce misses.
Does Lookup API replace a Monocle integration?
No. Lookup API enriches an IP address. Monocle assesses a browser session. Keep browser instrumentation if your workflow depends on session-level detection.
How do I move from Spur to Synthient?
Switch to Synthient’s endpoint and x-api-key header. Read provider, type, and last_seen from intelligence.providers[] instead of your existing Spur fields. Test the rules on labeled traffic; the migration guide covers request setup.
How was Spur’s service-tag count calculated?
On September 28, 2026, we counted 1,298 unique identifiers in Spur’s public directory: 934 VPN, 329 proxy, and 35 other tags, excluding two duplicates. Public tag counts do not measure detection accuracy or total private coverage.
Compare results on your IPs.
Bring a labeled traffic sample. Compare provider and reseller tags, missed proxies, and false positives with your current Spur results.