Bots, fraud and scrapers hide behind millions of real home and mobile connections rented out by residential proxy networks. We map global anonymization infrastructure as it changes in real time, so there's nowhere left to hide.
1.1.1.1152.59.24.167.20.0.0/20AS6079comcastoxylabsmy IPEvery product draws on the same continuously updated map of anonymization infrastructure.
A lightweight script that assesses each visitor's connection as the page loads, for session enrichment or in place of a CAPTCHA.
Score traffic as it arrives: what an IPv4 address, prefix or network is, who runs it, whether it hides its users and how risky it is.
Every residential proxy exit we observed in the last 30 days, as one download, for attribution, research and education, at a price the industry has never offered.
A residential proxy routes traffic through a real home IP address, but every connection still passes through the proxy's own machine. That extra hop leaves traces below the browser, where they can't be spoofed.
ISP proxies are subnets masquerading as home connections on real residential networks. We detect them more completely than six-figure enterprise feeds, and the Open API gives every detection away with no key. A paid key adds the residential proxy exits active right now, seconds after we see them.
$ curl https://api.layer3intel.com/open/48.44.1.10
{ "ip": "48.44.1.10", "type": "isp_proxy", "risk": { "score": 90, "level": "critical", "reasons": ["isp_proxy"] }, "flags": { "anonymizer": true, "proxy": true, "vpn": false, "tor": false, "relay": false, "hosting": true }, "location": { "country": "US", "region": "New York", "city": "New York City", "timezone": "America/New_York", "confidence": "high" }, "network": { "asn": 7922, "name": "Comcast Cable Communications, LLC", "type": "access", "prefix": "48.44.1.0/24", "registered": "2026-03-04", "rpki": "valid" }, "routing": { "shape": "stable", "first_seen": "2026-02-24", "origins": 1, "current_since": "2026-02-24" }}
Across the industry, residential proxy data like this is sold on six-figure enterprise contracts. Ours is self-serve: every residential proxy address we track, with the proxy providers it was seen with, when it was last seen and how many days it was seen, and every download is yours to use however you like. Resell it, publish it, build on it.
Scoring live traffic? New exits reach the Intel API within seconds; the feed is a copy you download once a day.
$ curl -OJ -H "Authorization: Bearer YOUR_API_KEY" \ https://api.layer3intel.com/feed/v1/residential_proxies
ip,last_seen,percent_days_seen,data_sources 203.0.113.42,1793541869,60,3;10;11;13;15;18 198.51.100.7,1793538204,100,1;4;22 192.0.2.188,1793460117,13,47 …
The Open API needs no key: curl api.layer3intel.com shows what it knows about your own address. An account adds 10,000 free credits on the full API, with no credit card required.