v1 · Free tier live

Detect VPN, proxy, and residential proxy traffic with the data your competitors can’t see.

Real-time API and bulk feeds. Free tier, no card.

NetFlow protocol attribution that no other provider exposes.

10,000 free lookups / month Sub-100ms p50 No credit card

wxaintel.wxapros.com

$ Request

curl -H "Authorization: Bearer wxa_live_…" \
  https://wxaintel.wxapros.com/api/v1/vpn/ip/1.1.1.1

200 OK · 38 ms

{
  "ip": "1.1.1.1",
  "classification": "cdn",
  "provider": "Cloudflare",
  "confidence": 0.99,
  "asn": 13335,
  "asn_org": "Cloudflare, Inc.",
  "observation_count": 4127,
  "risk_score": 12
}

classification · cdn

Detection Ladder

One API surface. Four anonymizer categories.

Every classification carries a confidence score, an ASN, and an observation count so you can tune thresholds per surface.

vpn

VPN

2.4M endpoints

200+ commercial providers attributed by name.

proxy

Proxy

Datacenter & residential

14 commercial providers, exit-IP level.

residential_proxy

Residential proxy

88M IPs

Hourly refresh from honeypot observation.

tor

Tor

All public exits

5-minute freshness from the directory.

What makes us different

Three signals other vendors don’t have.

Enterprise

NetFlow protocol attribution

Detect OpenVPN, WireGuard, IKEv2, and camouflaged-TLS endpoints invisible to scanners. 11K novel concentrators, 97.3% unique to WXA.

Pro & up

Honeypot residential attribution

We attribute residential-proxy exit IPs to specific commercial networks — BrightData, IPRoyal, Decodo, and more. No other public-facing provider does this transparently.

All tiers

Live data, hourly refresh

Not a weekly mirror. Real-time API from Free up. Daily MMDB at the Pro tier. Records age in hours, not weeks.

Drop in, ship today

One request. Real response.

Full reference

200 OK · 38 ms

curl -H "Authorization: Bearer wxa_live_…" \
  https://wxaintel.wxapros.com/api/v1/vpn/ip/1.1.1.1

// Response
{
  "ip": "1.1.1.1",
  "classification": "cdn",
  "provider": "Cloudflare",
  "confidence": 0.99,
  "asn": 13335,
  "asn_org": "Cloudflare, Inc.",
  "first_seen": "2023-08-12T00:00:00Z",
  "last_seen": "2026-04-28T08:14:22Z",
  "observation_count": 4127,
  "risk_score": 12
}

Pricing

Free for builders. Priced for scale.

Five tiers, transparent overage, no per-call surprises.

Start here

Free

Boolean flags for every category.

$0no card required

10,000 lookups / mo

VPN, proxy, Tor, hosting, CDN flags
Real-time API
Community support

Get a Free API Key

Starter

VPN provider attribution layered on the flags.

$49/mo

150,000 lookups / mo

Everything in Free
Named VPN provider (Mullvad, Proton, …)
Email support

Start with Starter

Pro

Bulk feeds and connection-type classification.

$149/mo

1,000,000 lookups / mo

Everything in Starter
Daily MMDB + CSV exports
Connection type (datacenter / residential / mobile)

Start with Pro

Business

Residential proxy attribution + Parquet feeds.

$349/mo

5,000,000 lookups / mo

Everything in Pro
Residential proxy provider attribution
Parquet exports for warehouse pipelines

Start with Business

Enterprise

NetFlow protocol attribution + SVU/RAI signals.

from $3K/mo

Unlimited

Everything in Business
NetFlow protocol attribution (OpenVPN, WireGuard, IKEv2, TLS-camo)
Shadow VPN Use & Remote Access Infrastructure intel
Dedicated support + SLA

Talk to sales

15% off when billed annually. Overage is charged per 1,000 lookups at the next tier’s effective rate.

2.84Munique IP records

88Mresidential proxy IPs across 14 providers

97.3%novel NetFlow concentrators not in any public DB

99.5%uptime SLA · hourly refresh

Stop the proxy abuse you can’t see today.

Free 10,000 lookups, no card. Live API in under two minutes — attribute the traffic your scoring engine is missing.

Get a Free API Key Talk to sales