Fraud and account takeover
Stop sign-ups, logins and checkouts arriving through ISP and datacenter proxies, residential exits, VPNs and Tor.
Intel API
IP intelligence that sees every proxy
The world's best ISP and datacenter proxy detection, plus hosting detection, on every IPv4 address, prefix and network, free on the Open API with no key. A paid key adds the residential proxy exits active right now: 6M+ observed every hour, served within seconds of being seen.
No credit card. The Open API needs no account at all.
Address lookups
Address context
Subnet lookups
Network (ASN) lookups
Paid: live data
Residential proxy exitSeen today, 30 of 30 days, with its providers
Paid key
curl -s "api.layer3intel.com/v1/203.0.113.42?key=YOUR_API_KEY" | jq{ "ip": "203.0.113.42", "type": "residential", "risk": { "score": 75, "level": "high", "reasons": [ "residential_proxy" ] }, "flags": { "anonymizer": false, "proxy": true, "residential_proxy": true, "vpn": false, "tor": false, "relay": false, "hosting": false }, "residential_proxy": { "score": 100, "last_seen": "2026-11-01", "days_seen_30d": 30, "days_seen_7d": 7, "providers": [ "Oxylabs", "Infatica", "IPRoyal", "Bright Data" ] }, "location": { "country": "US", "region": "California", "city": "San Jose", "latitude": 37.3394, "longitude": -121.895, "timezone": "America/Los_Angeles", "confidence": "high" }, "network": { "asn": 7922, "name": "Comcast Cable Communications, LLC", "type": "access", "prefix": "203.0.113.0/24", "registered": "2010-03-17", "rpki": "valid", "abuse_email": "[email protected]", "company": "Comcast Cable Communications, LLC" }, "routing": { "shape": "stable", "first_seen": "2008-11-15", "origins": 1, "current_since": "2010-04-02" }, "proxy_map": { "exits_24": 251, "always_on_24": 122 }}
- Residential proxy IPs observed every hour
- 6M+
- From a new exit's first sighting to the API
- Seconds
- Live residential proxy IPs tracked
- 70M+
- Signals collected every day
- 500M+
Free, for the first time
Proxy detection the industry sells on six‑figure contracts. Now free.
ISP proxies are announced on real residential networks, built to pass as the home connections around them. We catch them, and the datacenter proxies hiding among ordinary servers, more completely than the enterprise feeds do.
Every one of those detections is on the Open API, along with hosting, VPNs, Tor, privacy relays and corporate gateways.
- Price
- Free
- API key
- Not required
- Sign-up
- Not required
- IP intelligence industry
- Disrupted
| Feature | OpenFreeNo key, no sign-up | PaidFrom $100a month, after 10,000 free credits |
|---|---|---|
| Detection | ||
| ISP proxiesproxy subnets posing as home broadband on residential networks | Included | Included |
| Datacenter proxiesproxy servers on hosting and data center networks | Included | Included |
| VPN servers and Tor exits | Included | Included |
| Hosting and cloud, with the organization named | Included | Included |
| Privacy relays and corporate gateways, namediCloud Private Relay, Cloudflare WARP, Zscaler and more | Included | Included |
| Risk score with reasons, location and routing history | Included | Included |
| Address, subnet and network lookups | Included | Included |
| Live residential proxy data | ||
| Residential proxy exits, seconds after they are seen | Not included | Included |
| Exit score, history and the providers selling it | Not included | Included |
| Proxy, VPN and Tor operators named | Not included | Included |
| Lessors and brokers behind the space | Not included | Included |
Live residential proxy data
Residential proxies, seconds after they're seen
A residential proxy exit is a real subscriber's line, invisible to any static list. We observe 6 million of them every hour across every major pool and serve each new one within seconds: whether an address is an exit right now, how often it has been, and who is selling it.
Seen within seconds
A new exit reaches the API seconds after we first see it, so the address you score is judged on what it is doing now.
Every major pool
6 million unique exits an hour across every major residential proxy network, with the providers named on each one.
History you can weigh
Last seen, days seen in the last 30 and 7, and a 0–100 score: a busy exit and an old sighting never read the same.
Built for
Every decision that depends on an IP
Bots and ad fraud
Tell real subscribers from traffic routed through proxy subnets and pools, and name the crawlers you want.
Security operations
Enrich every alert with the network, its routing history, RPKI status and the abuse contact.
Threat research
Attribute addresses, subnets and whole networks to the providers and companies behind them.
Pricing
Free to start. Priced by the lookup.
Every plan gets the full paid answer; plans differ only in credits. An address costs one credit.
Open
Free
No key, no sign-up
Recon
$100/month
200,000 credits a month
Sentinel
$200/month
500,000 credits a month
Detect
$300/month
1,000,000 credits a month
Enterprise
Custom
Volume, SLA, the raw signal feed
Start free, right now
The Open API needs no key: curl api.layer3intel.com shows what it knows about your own address. An account adds 10,000 free credits on the full API, with no credit card required.