How is it different from Hosting IP?

Hosting IP is the space hosting providers own. This is the individual addresses inside it that we saw a proxy service sell as exits: one says an address is infrastructure, the other that someone is renting it out.

Which window should we use?

90 days is the widest net. The 1, 7, 14, 30 and 60-day windows are the same observations over shorter spans, each its own dataset, for when an address seen two months ago is too old to act on.

How do we read hits and hits_days_pct?

hits counts the observations in the window and hits_days_pct is the share of its days the address appeared on. An address seen most days is a standing exit; one seen once may have joined a pool for an afternoon.

Rotating proxy pools on leased infrastructure.

Proxy exits running on datacenter address space, with observation counts across a rolling ninety-day window.

Request access

Schema

See documentation →

Published as CSVGZ and MMDB. Every column is described in the docs.

ip	provider	first_seen	last_seen	hits	hits_days_pct	providers_num
46.203.63.189	floppydata	2026-06-11	2026-07-30	13	9	3
18.237.13.41	floppydata	2026-07-06	2026-09-04	9	8	2
45.67.3.193	floppydata	2026-08-29	2026-09-06	2	1	2
52.52.254.47	floppydata	2026-06-30	2026-06-30	1	1	1
217.80.249.248	floppydata	2026-08-30	2026-08-30	1	1	1

dcproxy_ip_90d_v1

Entries

909,522

Refresh

Daily

CSVGZ

6.64 MB

MMDB

21.94 MB

Datacenter Proxy Provider

The operators behind the ids.

Datacenter Proxy Provider documentation →

provider is an id that holds from build to build. Datacenter Proxy Provider resolves each one to the provider's name and homepage, whether we track its addresses and whether it has gone defunct. Join it on provider.

id	name	url	active	note	defunct
dataimpulse	DataImpulse	https://dataimpulse.com/	t		f
ipvanish	IPVanish	https://www.ipvanish.com/	t	VPN service that offers a SOCKS5 proxy via datacenter nodes.	f
privateproxy_me	PrivateProxy.me	https://privateproxy.me/	t		f

dcproxy_provider_v2

Entries

Downloading it from code.

Database API reference →

One call gets you the current Datacenter Proxy IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.

download()

Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.

downloadUrl()

The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.

downloadBytes()

The build in memory, for a small dataset or a pipeline that never touches a filesystem.

metadata()

Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.

checksums()

The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.

import os
from vpndetection import VPNDetection
 
client = VPNDetection(os.environ["VPNDETECTION_API_KEY"])
 
# to disk, streamed
client.database.download("dcproxy_ip_90d_v1", "csvgz", "dcproxy_ip_90d_v1.csv.gz")
# a time-limited link
url = client.database.download_url("dcproxy_ip_90d_v1", "csvgz")
# in memory
raw = client.database.download_bytes("dcproxy_ip_90d_v1", "csvgz")

download.pypip install vpndetection

Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

What it's used for

Three decisions Datacenter Proxy IP is bought for, and what each needs from the data rather than from a score.

Cheap abuse arrives here first

Datacenter proxies are the lowest-cost way to rotate an address, which makes them the highest-volume source of automated abuse.

Distinct from plain hosting

A server range is not necessarily a proxy. This dataset is the subset actually observed exiting proxy traffic.

Rotation is visible

First seen, last seen and hit counts show how a pool churns, so short-lived exits can be scored differently.

License the full database

Sales will quote on volume, term and whether you need redistribution rights.

Checksums published per file: md5, sha1, sha256 and sha512.

The id pins the schema version, so a new build never changes the columns your parser reads.

Samples are cut from the current build, not a synthetic extract.

Get a quote See documentation

Official SDKs

All SDKs on GitHub →

Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.

Node.js Python Go Java .NET PHP Ruby Rust Swift Erlang Perl Zig Express Fastify Next.js Django Flask FastAPI Laravel Symfony Rails Spring Boot ASP.NET Core net/http Gin Axum Cowboy

Common questions

Read the docs →API reference →Email support →

On this page

What does a row tell us?

One address seen exiting a datacenter proxy pool in the window, the provider that sold it, the first and last day it appeared, how many times, the share of days it appeared on, and how many providers resold it.

00 · No key

Start without signing up.

Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.

curl "https://api.vpndetection.io/146.70.116.130"

{
  "ip": "146.70.116.130",
  "is_vpn": true
}

01 · Free key

Sign up and get 50,000 requests a month.

No card and no sales call: the key is issued on signup.

Every request flags VPN IPs.

Upgrade only when you outgrow the allowance.

Get a free API key See pricing