Public proxy detection API: open proxies at both ends

Since October 18, the API answers is_pubproxy: whether the address sits at either end of a public proxy, an open HTTP, HTTPS or SOCKS proxy that anyone can send traffic through, with no account and no payment. The same data ships as Public Proxy IP, a database in six windows.

What a public proxy is

A public proxy takes connections from anyone who knows its address and port: an HTTP proxy, an HTTP proxy that also tunnels HTTPS connections (CONNECT), or a SOCKS4 or SOCKS5 proxy. They cost nothing to use, so they turn up wherever a large number of attempts matters more than any one of them: credential stuffing, scraping and spam signups.

They're a different thing from the residential, datacenter and mobile proxies the API already flags, which people pay a proxy network to use. An open proxy is one address that forwards whatever it's sent. Of the 3,000 we looked up for this post (below), 2,209 were on networks the API types as isp and 700 on hosting.

What a lookup answers

Here's the answer for an address that public proxies' traffic left from on October 24, looked up on October 25 with a Max key, its ip, location and asn cut:

{
  "is_vpn": false,
  "is_hosting": false,
  "is_relay": false,
  "is_tor": false,
  "is_cdn": false,
  "is_resproxy": false,
  "is_dcproxy": false,
  "is_mobproxy": false,
  "is_pubproxy": true,
  "vpn": {},
  "hosting": {},
  "relay": {},
  "tor": {},
  "cdn": {},
  "resproxy": {},
  "dcproxy": {},
  "mobproxy": {},
  "pubproxy": {
    "entry": false,
    "exit": true,
    "protocols": [
      "http",
      "https"
    ],
    "num_ports": 0,
    "num_proxies": 3,
    "last_seen": "2026-10-24",
    "last_usable": "2026-10-24"
  }
}

Every other flag is false, so a rule built on the eight older flags lets this address through. The pubproxy object says what it is:

The flag covers the last 90 days, like the other proxy flags. is_pubproxy and its object come with every paid plan, from Starter up. A free key or none leaves both out, and a field your plan doesn't include is missing, never false (pricing). All twelve SDKs read the new fields, as isPubproxy in Node.js and is_pubproxy in Python.

Both ends of the proxy

A request through a proxy often arrives from a different address than the one the proxy listens on. That's why every exit is its own row, marked as one. In the one-day window of October 24, 2026:

• 16,088 addresses were at one end of a public proxy or the other: 13,464 entries and 8,255 exits.
• 2,624 of the exits (32%) were exits only. No proxy listened on them, so a blocklist of the addresses proxies listen on would never have held them, and they're the addresses your logs show.
• 3,605 exits (44%) carried traffic from two or more proxies, and the busiest from 26.

The protocols, counted per address: http on 10,615, https on 6,824, socks5 on 2,567 and socks4 on 2,295.

Working, or gone quiet

Most open proxies work only some of the time. Of the 13,464 entries, 8,852 (66%) had a proxy answer a request through it on October 24. At the other 4,612, no request through a proxy had been answered, so their last_usable is empty. A rule can weigh an address whose proxy answered yesterday above one where no proxy ever has.

What the other flags already catch

On October 25 we looked up 3,000 IPv4 addresses picked at random from that day's window, on a Max key, and counted the other flags each answered:

483 of the 3,000 (16%) answered no flag but is_pubproxy. Three in four exits only had also been seen in a residential proxy pool, and entries only were the likeliest to be on hosting space.

Adding it to a rule

If your code lists the flags it treats as masked, add is_pubproxy to the list. We've done that in the age-gate code of Utah SB 73: what a site can and can't know about VPN users and the Online Safety Act post, and reran both with an open proxy among the visitors. An open proxy on a hosting network is a server, which nobody's home line shares. One on an ISP's address may be someone's own connection, so send it to a check rather than turning it away.

The database

Public Proxy IP comes in six rolling windows, 1, 7, 14, 30, 60 and 90 days, rebuilt daily. A row is one address, with a lookup's fields plus its country: ip, exit, entry, protocols, num_ports, num_proxies, country, last_seen and last_usable. It ships as a gzipped CSV and an MMDB of the same rows, so the file works as a blocklist as it is, and a lookup by the address a request came from finds an exit. The 90-day window held 30,358 rows on October 25.

The docs describe every column and give the download call. The database page has a sample cut from the current build, and the full files are licensed: talk to us about yours.

Getting started

Sign up for a key and choose a plan on pricing: Starter and up answer is_pubproxy from the first lookup. The API docs have the full response.