Synthient
Contact

Proxy Detection For The Modern Web.

Detect residential proxies, datacenter proxies, mobile proxies, VPNs, and Tor exits in real time. Wire provider, network type, and risk fields into the rules and policies you already run.

Try the dataGet in touch

Overview

All Services Healthylatest snapshot 7m ago4/10 streams purchased22.5K lookups (24h)

Lookup success
99.15%
22.5K lookups (24h)
Residential Proxies (24H)
34.4M
2%
Median risk score
92
high severity
Team users
1 / 5
seats used
Firehose lag
1.2s
healthy
Activity

Lookups over time

Lookups
22,468
Errors
192 errors
Geography

Threat Landscape

Signals

Pinned intelligence

Starred targets, provider movement, and workspace announcements.

Starred items

3/5 saved
ItemTypeUpdatedStarred
birdproxiesProvider profileProvider43d ago
google.comDomain contextDomain44d ago
AS7922ASN contextASN45d ago

Top providers

top 3 · 24h
  1. 1
    9PROXY9.6M
    PROXY_FIREHOSE · residential28%
  2. 2
    BOTTINGTOOLS_BASIC6.8M
    BASIC · residential20%
  3. 3
    IPIDEA_PDK4.7M
    PROXY_FIREHOSE · mobile14%

Latest announcements

2 latest
  • Feeds12m ago

    Feed archive calendar is live

    Historical exports can now be filtered by year, month, and day from each feed stream.

  • Lookup API1h ago

    Provider pivots refreshed

    Lookup API provider pages now include updated ASN, subnet, and country relationships.

3 team members · 2 pending invitesFeed freshness 7m · all 10 streams on scheduleNext key expiry in 7d · Staging exporter

Tracking 600+ VPN and Proxy Services

Synthient unmasks fraudulent traffic in realtime. Threats move fast. A good defense acts faster.
01

Lookup API: Query the internet at your fingertips.

Get ASN, ISP, network type, location, proxy provider, behavior, device context, and a 0-100 risk score in a single response.

Lookup API
  • IPv4 and IPv6 lookup
  • Provider attribution
  • Behavior arrays
  • Batch enrichment
View Lookup API
Lookup Response
23-28
21"intelligence": {
22"risk_score": 96,
23"behavior": ["PROGRAMMATIC_TRAFFIC"],
24"categories": ["RESIDENTIAL_PROXY"],
25"devices": [
26{ "os": "Linux", "version": "i386" },
27{ "os": "iOS", "version": "11.0" }
28],
29"providers": [
30{
31"provider": "LUNAPROXY",
32"type": "RESIDENTIAL_PROXY",
33"last_seen": 1776729600
34},
35{
36"provider": "BRIGHTDATA",
37"type": "RESIDENTIAL_PROXY",
38"last_seen": 1777248000
39}
02

Feeds: Access frontier datasets at your fingertips.

Pull proxy, VPN, relay, and anonymizer datasets into any warehouse, notebook, or review workflow. Use hourly snapshots for fresh decisions and historical partitions for backfills, audits, and investigations.

Feed datasets
  • Hourly and Daily snapshots
  • Historical Partitions
  • Developer Friendly
  • Parquet Support

Feeds

Feeds

8 of 10 datasets unlockedlatest hourly snapshot 7m agohistorical partitions available

Datasets10 datasets

Proxies

GET /api/v4/feeds/proxies/export/latest
scope active
kindsnapshotrowssizecreatedartifact

Exports expose id, checksum, row_count, size_bytes, and download_path — the same fields as /api/v4/feeds/proxies/export.

Export activity

last 24h
proxies hourly snapshot completed · 08:00 UTCanonymizers historical backfill ready · Jun 10
03

Firehose: Enabling organizations to write real-time detections.

Use second-precision proxy observations to detect suspicious traffic as it happens. Firehose streams thousands of events per second into fraud, auth, SIEM, and Kafka workflows so your systems can block, challenge, or review risky activity immediately.

Firehose
  • Second precision
  • Thousands of events/s
  • Realtime detections
  • Fraud, auth, and SIEM routing
View Firehose workflow
04

Helios: Understand how your attackers pivot.

Helios captures real traffic from botnets so teams can understand how attackers operate. The first generation of real proxy detection.

Helios evidence
  • Botnet traffic capture
  • Targeted domains and paths
  • HTTP, TLS, DNS, and ADB captures
  • Exit IPs
View Helios
Botnet traffic live
google.comTARGETED
One pivot

Helios captures live botnet traffic as it moves through a real proxy path.
PLANS

Pay for the precision you need.

01

Researcher

$20Kper year

Look up any IP or domain through the Lookup API with full network, provider, and risk context, refreshed daily.

API lookups
4M/month
Precision
Daily granularity
Best fit
Research and daily checks
Delivery
Lookup API responses
Surfaces
Lookup API
Feeds
Firehose
Helios
Purchase
02

Startup

$65Kper year

Download complete proxy, VPN, relay, and crawler datasets as Feeds snapshots, refreshed every minute.

API lookups
6M/month
Precision
Minute granularity
Best fit
Seed teams and warehouses
Delivery
API plus feed snapshots
Surfaces
Lookup API
Feeds
Firehose
Helios
Purchase
03

Business

$85Kper year

Wire the Firehose straight into your fraud, auth, and abuse systems. Detections stream within seconds.

API lookups
8M/month
Precision
Second granularity
Best fit
Production detections
Delivery
API, feeds, and stream
Surfaces
Lookup API
Feeds
Firehose
Helios
Purchase
04

Enterprise

Get in touch

Helios observation data with dedicated scopes, security reviews, and direct support, shaped around your stack.

API lookups
Custom
Precision
Custom precision
Best fit
Enterprise programs
Delivery
All surfaces and Helios
Surfaces
Lookup API
Feeds
Firehose
Helios
Purchase
FAQ

Direct answers.

Need specifics on access, pricing, or fit? Reach the team directly.

Email uscontact@synthient.comSchedule a call30 min
  • Q1

    Do you offer free trials?

    Yes. We offer scoped evaluations for qualified teams so you can test lookup responses, feed samples, and integration fit before a commercial rollout.

  • Q2

    Can I make historical lookups?

    Yes. Historical analysis is available through retained feed snapshots and plan-scoped data access. The Lookup API is optimized for current enrichment, while Feeds are built for backfills and warehouse joins.

  • Q3

    Are there any commercial restrictions to the data?

    Commercial use is governed by your signed agreement. Internal fraud, abuse, access, and security workflows are supported; resale, redistribution, or public mirroring requires explicit permission.

  • Q4

    What is the difference between Proxy Feeds and the Proxy Firehose?

    Proxy Feeds are verified Parquet snapshots for batch jobs, backfills, and warehouse-scale analysis. Proxy Firehose is a live NDJSON stream for new observations that need to update policy quickly.

  • Q5

    What kind of support do you offer?

    We help with onboarding, schema mapping, API and CLI integration, feed delivery, Firehose filters, and production rollout questions. Enterprise plans can include deeper review and dedicated support paths.
free scanno account required

Check if your platform is targeted by residential proxies.

Enter a domain and see the Helios-style evidence Synthient uses to connect proxy traffic, provider clusters, and recent observations to one review.