Intelligence API

Proxies, VPNs, and Tor Exit nodes provide a shared risk for businesses. To help mitigate this risk, Synthient offers a comprehensive IP intelligence API that can be used to detect these threats before they can interact with your application.

GET/api/v2/intel/ip/:ip

IP Lookup

Static Detections

While competitors may use other services or rely on outdated data, Synthient uses an in-house database that is updated daily. Using a variety of methods we offer one of the largest databases of IP intelligence data available.

There is an overlap between our VPN and Datacenter count, residential proxies have been filtered to only include unique IP's.

Data Type	Count
Residential Proxies	20M+
VPNs	192M+
Datacenters	144M+
Abusive IP's	173K+
Tor Exit Nodes	1K+

Dynamic Detections

Synthient uses a combination of static and dynamic detections to provide accurate results.

Users who care primarily about IP information can query the IP data directly. This endpoint will return the same IP information from the lookup endpoint but will not include the visitor information.

Returns intelligence data about the IP address.

Attributes

Name
ip
Type
string
Description
The ip address that was queried.
Name
intel
Type
object
Description
The intelligence object will contain numerous datapoints about the visitor's ip address.
Name
intel.tags
Type
string[]
Description
Array of tags that are associated with the ip address.
Name
intel.asn
Type
number
Description
The ASN of the ip address.
Name
intel.isp
Type
string
Description
The ISP of the ip address.
Name
intel.device_count
Type
number
Description
The number of devices that have been seen using this ip address.
Name
location
Type
object
Description
Location data associated with the ip address.
Name
location.city
Type
string
Description
City of the ip address.
Name
location.region
Type
string
Description
Region of the ip address.
Name
location.country
Type
string
Description
Country of the ip address.
Name
location.country_code
Type
string
Description
Country code of the ip address.
Name
location.latitude
Type
number
Description
Latitude of the ip address.
Name
location.longitude
Type
number
Description
Longitude of the ip address.

Tag	Description
`VPN`	IP address is associated with a vpn service.
`TOR`	Tor Exit Node
`RESIDENTIAL_PROXY`	Residential Proxy
`MOBILE`	Mobile ISP
`DATACENTER`	Datacenter IP
`POTENTIAL_BOT`	Network has an associated bot on it, could be a possible proxy
`ABUSIVE`	IP address associated with some sort of malicous activity
`PUBLIC_PROXY`	Public proxy that anyone can use to obscure their traffic

Request

GET

/api/v2/intel/ip/:ip

curl -G https://api.synthient.com/api/v2/intel/ip/{ip} \
  -H "Authorization: {api_key}"

{
  "ip": "67.183.XX.XX",
  "intel": {
      "tags": [
        "VPN",
        "TOR",
        "RESIDENTIAL_PROXY",
        "PUBLIC_PROXY",
        "MOBILE",
        "DATACENTER",
        "ABUSIVE",
        "POTENTIAL_BOT"
      ],
      "asn": 20055,
      "isp": "Whidbey Telephone Company",
      "device_count": 1
    },
    "location": {
      "city": "Seattle",
      "region": "Washington",
      "country": "United States",
      "country_code": "US",
      "latitude": 47.6061,
      "longitude": -122.3328,
  },
}

GET/api/v2/email/:email

Email Lookup

Attributes

Name
email
Type
string
Description
Email address
Name
group
Type
enum
Description
Grouping value for the recommended action taken.
Name
group.TRUSTED
Type
string
Description
Reserved for known high level domains such as outlook or gmail.
Name
group.STANDARD
Type
string
Description
Standard level assigned to emails that aren't a high level domain but aren't associated with malicous activity.
Name
group.DISPOSABLE
Type
string
Description
Email is from a known disposable domain.
Name
group.BLOCK
Type
string
Description
Known spammer or malicous email.

Request

GET

/api/v2/email/:email

curl -G https://api.synthient.com/api/v2/intel/email/{email} \
  -H "Authorization: {api_key}"

{
  "email": "[email protected]",
  "group": "TRUSTED"
}