Which window should we use?

90 days is the widest net. The 1, 7, 14, 30 and 60-day windows are the same observations over shorter spans, each its own dataset, for when an address seen two months ago is too old to act on.

How do we read hits and hits_days_pct?

hits counts the observations in the window and hits_days_pct is the share of its days the address appeared on. An address seen most days is a standing exit; one seen once may have joined a pool for an afternoon.

Should we block every address in it?

Not on presence alone: these are real home connections, often still used by the people they belong to. An address seen on most days by several providers is a committed exit; one seen once is weaker evidence, and a challenge fits it better than a block.

Consumer connections resold as proxy exits.

Home addresses enrolled into proxy networks, with how often we saw them, how persistent they are, and how many networks resell the same address.

Request access Download sample

Schema

See documentation →

Published as CSVGZ. Every column is described in the docs.

ip	provider	first_seen	last_seen	hits	hits_days_pct	providers_num
138.97.217.21	netnut	2026-06-23	2026-09-06	8	2	7
113.188.74.104	dataimpulse	2026-08-09	2026-08-13	17	6	2
45.173.157.0	netnut	2026-06-15	2026-07-31	2	1	2
191.127.13.37	netnut	2026-06-22	2026-06-23	5	1	3
2804:2980:f651:2b00:8a7f:a380:8e43:db1a	anyip	2026-08-14	2026-08-14	1	1	1

resproxy_ip_90d_v1

Entries

114,377,137

Refresh

Daily

CSVGZ

1.37 GB

Residential Proxy Provider

The operators behind the ids.

Residential Proxy Provider documentation →

provider is an id that holds from build to build. Residential Proxy Provider resolves each one to the provider's name and homepage, whether we track its addresses and whether it has gone defunct. Join it on provider.

id	name	url	active	defunct
brightdata	Bright Data	https://brightdata.com/	t	f
oxylabs	Oxylabs	https://oxylabs.io/	t	f
soax	SOAX	https://soax.com/	f	f

resproxy_provider_v3

Entries

869

Downloading it from code.

Database API reference →

One call gets you the current Residential Proxy IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.

download()

Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.

downloadUrl()

The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.

downloadBytes()

The build in memory, for a small dataset or a pipeline that never touches a filesystem.

metadata()

Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.

checksums()

The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.

import os
from vpndetection import VPNDetection
 
client = VPNDetection(os.environ["VPNDETECTION_API_KEY"])
 
# to disk, streamed
client.database.download("resproxy_ip_90d_v1", "csvgz", "resproxy_ip_90d_v1.csv.gz")
# a time-limited link
url = client.database.download_url("resproxy_ip_90d_v1", "csvgz")
# in memory
raw = client.database.download_bytes("resproxy_ip_90d_v1", "csvgz")

download.pypip install vpndetection

Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

What it's used for

Three decisions Residential Proxy IP is bought for, and what each needs from the data rather than from a score.

The hardest traffic to catch

Residential proxies look exactly like customers because they are customers, rented out. Persistence data is what separates them.

Score by persistence, not presence

An address seen once in ninety days is a different signal from one seen daily across seven networks. Both are in here with the counts to tell them apart.

Know who is reselling

providers_num tells you how many networks resell the same address, a strong indicator of a committed node.

License the full database

Sales will quote on volume, term and whether you need redistribution rights.

Checksums published per file: md5, sha1, sha256 and sha512.

The id pins the schema version, so a new build never changes the columns your parser reads.

Samples are cut from the current build, not a synthetic extract.

Get a quote See documentation

Official SDKs

All SDKs on GitHub →

Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.

Node.js Python Go Java .NET PHP Ruby Rust Swift Erlang Perl Zig Express Fastify Next.js Django Flask FastAPI Laravel Symfony Rails Spring Boot ASP.NET Core net/http Gin Axum Cowboy

Common questions

Read the docs →API reference →Email support →

On this page

What does a row tell us?

One address seen exiting a residential proxy pool in the window, the provider that sold it, the first and last day it appeared, how many times, the share of days it appeared on, and how many providers resold it.

00 · No key

Start without signing up.

Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.

curl "https://api.vpndetection.io/146.70.116.130"

{
  "ip": "146.70.116.130",
  "is_vpn": true
}

01 · Free key

Sign up and get 50,000 requests a month.

No card and no sales call: the key is issued on signup.

Every request flags VPN IPs.

Upgrade only when you outgrow the allowance.

Get a free API key See pricing