Feeds

Bulk data is available for clients who want to perform large-scale analysis or integrate Synthient data into their own systems. This includes options for data exports, API access, and custom data feeds.

Data Feeds

The feeds are delivered as a gzipped file in JSONL, CSV, or TEXT format which can be fetched on the https://feeds.synthient.com domain.

Enterprise customers will also be provided with a direct clickhouse connection to run SQL queries directly on the Synthient database.

GET/v3/feeds/anonymizers

Fetching Anonymizers

The anonymizers feed endpoint allows users to create a full copy of the database or export specific segments of data. This is the equivalent to running a SQL query on the entire dataset.

Name
provider
Type
string | null
Description
The name of the provider to filter by. If null, returns all provider.
Name
type
Type
string | null
Description
The type of anonymization service to filter by. If null, returns all types. Please note it's redudant to provide both provider and type in the same request.
Name
last_observed
Type
string | null
Description
Filter by how recently the IP was observed. For example 24H, 7D, or 1M. If null, returns all records regardless of last observed date.
Name
format
Type
string
Description
The format of the returned data. Options are JSONL, CSV, or TEXT. Defaults to CSV.
Name
country_code
Type
string | null
Description
Filter results to only include IPs from the specified country code, like 'US' or 'DE'. If null, returns all countries.
Name
full
Type
boolean
Description
If true, returns all records. If false, results are distinct on ip_address and provider. Defaults to false.
Name
order
Type
string
Description
The sort order for results. Options are asc or desc. Defaults to desc.

Request

GET/v3/feeds/anonymizers

curl https://feeds.synthient.com/v3/feeds/anonymizers \
  -H "Authorization: $API_KEY" \
  --url-query "provider=BIRDPROXIES" \
  --url-query "type=RESIDENTIAL_PROXY" \
  --url-query "last_observed=7D" \
  --url-query "format=CSV" \
  --url-query "country_code=US" \
  --url-query "full=false" \
  --url-query "order=desc"

Responses

ip_address,provider,category,last_observed,country_code
2601:182:b01:4390:153d:2f4f:fc6e:2f9d,INFATICA,RESIDENTIAL_PROXY,2025-11-08 14:43:15+00:00,US
223.206.237.168,PROXYJET,RESIDENTIAL_PROXY,2025-11-08 14:43:15+00:00,TH
223.190.84.45,IPIDEA,RESIDENTIAL_PROXY,2025-11-08 14:43:15+00:00,IN
223.185.43.134,ANYIP_MOBILE,RESIDENTIAL_PROXY,2025-11-08 14:43:15+00:00,IN
... // more lines

GET/v3/feeds/blacklist

Fetching Blacklist

The blacklist feed provides a list of IP ranges that are associated with malicious or unwanted activity.

Name
provider
Type
string | null
Description
The name of the provider to filter by. If null, returns all provider.
Name
type
Type
string | null
Description
The type of anonymization service to filter by. If null, returns all types.
Name
format
Type
string
Description
The format of the returned data. Options are JSONL, CSV, or TEXT. Defaults to CSV.
Name
order
Type
string
Description
The sort order for results. Options are asc or desc. Defaults to desc.

Request

GET/v3/feeds/blacklist

curl https://feeds.synthient.com/v3/feeds/blacklist \
  -H "Authorization: $API_KEY" \
  --url-query "provider=NORDVPN" \
  --url-query "type=COMMERCIAL_VPN" \
  --url-query "format=CSV"

Responses

cidr,provider,category,last_observed
2.56.252.0/24,NORDVPN,COMMERCIAL_VPN,2025-11-08 14:43:15+00:00
2.58.36.0/22,NORDVPN,COMMERCIAL_VPN,2025-11-08 14:43:15+00:00
... // more lines

Specifying TEXT Format

When format=TEXT is specified, the response will be a plain text list of IP addresses, one per line, in the format ip #provider. This format is useful for importing into systems that accept plain text input.

The TEXT format does not include any additional metadata or fields, only the IP address and provider. For the blacklist feed, IPs are in CIDR notation.

188.136.74.173 #BIRDPROXIES
... // more lines