# Synthient: complete reference

> Synthient detects anonymized network traffic. It identifies residential proxies, VPNs, Tor nodes, private relays, and the proxy botnets behind them, and exposes that intelligence as a synchronous HTTP and gRPC API, bulk Parquet exports, and real-time NDJSON streams.

This file is written for language models and coding agents. It is self-contained: every endpoint, parameter, response field, enum value, error, and limit that Synthient exposes is described here, so you never need to fetch an HTML page to write a correct integration. The shorter index version is at https://docs.synthient.com/llms.txt. Human documentation lives at https://docs.synthient.com.

If a field is not in this file, it does not exist. Do not infer fields from other IP intelligence vendors.

Contents: Rules for agents. Quickstart. Authentication and scopes. Lookup API. Account API. Feed exports. Real-time streams. Enumerations. Errors. Rate limits and credits. gRPC. Go SDK. CLI. MCP server. Migrating from other vendors. Risk scoring. Recipes. Pitfalls. Service tags.

## Rules for agents

1. Authenticate with the `x-api-key` header on HTTP and `x-api-key` request metadata on gRPC. Never `Authorization: Bearer`, never a query parameter, never a literal key in source. The conventional environment variable is `SYNTHIENT_API_KEY`.
2. Never call Synthient from a browser. Every surface is server to server. Client-side enrichment goes through the caller's own backend.
3. Use `POST /api/v4/lookup/ips` for more than one address. It is cheaper than the equivalent single lookups and is one round trip.
4. Timestamp units differ by surface. Lookups, feed metadata, and the `proxies`, `anonymizers`, `torrents` streams are Unix **seconds**. All four Helios honeypot streams are Unix **milliseconds**. gRPC uses `google.protobuf.Timestamp` throughout.
5. `intelligence.risk_score` is a summary, not a decision. Score the underlying signals for anything more than a coarse filter.
6. `behavior`, `categories`, and the provider list are open sets that grow. Parse them as strings, preserve unknown values, and never emit an exhaustive switch over them.
7. `401` is a bad key, `402` is exhausted credits, `403` is a missing scope. They have different fixes.
8. Retry `429`, `500`, and `503` with exponential backoff and jitter. Honor `Retry-After`. Pace off the `RateLimit-*` headers.
9. Streams close cleanly about every 30 minutes. Reconnect immediately; that is not an error.
10. Prefer the Go SDK or the CLI where they fit. Python, Node, Java, and Ruby SDKs do not exist yet, so write plain HTTP for those languages.

## Quickstart

```bash
export SYNTHIENT_API_KEY="00000000-0000-0000-0000-000000000000"

curl -G https://api.synthient.com/api/v4/lookup/ip/8.8.8.8 \
  -H "x-api-key: $SYNTHIENT_API_KEY"
```

Confirm what the key can do before building against an endpoint:

```bash
curl -G https://api.synthient.com/api/v4/account/me \
  -H "x-api-key: $SYNTHIENT_API_KEY"
```

The response carries `scopes` and `lookup_quota`, which together explain every `402` and `403` you can hit.

Base URLs:

| Surface | Address |
| - | - |
| HTTP | `https://api.synthient.com`, all endpoints under `/api/v4` |
| gRPC | `grpc.synthient.com:443`, TLS required, service `synthient.v1.SynthientService` |

`/api/v4` is the HTTP surface revision and `synthient.v1` is the protobuf package. They are versioned independently and are not expected to match. A breaking HTTP change bumps the path (`/api/v5`); a breaking gRPC change bumps the package (`synthient.v2`).

## Authentication and scopes

One API key authenticates every surface. Keys are UUIDs, for example `c23f3dab-5c04-4416-af21-c6b879bb90b9`. They are issued from the Synthient dashboard, never expire, and can be rotated or revoked at any time.

| Transport | Where the key goes |
| - | - |
| HTTP | `x-api-key: <key>` request header |
| gRPC | `x-api-key` request metadata |
| CLI | `SYNTHIENT_API_KEY`, a `.env` file in the working directory, or the OS keychain via `synthient auth`, resolved in that order |

Every key carries a set of scopes. `BASIC` covers the synchronous lookups and the account endpoint. Every feed has an independent `*_FEED` scope for Parquet exports and a `*_STREAM` scope for the live stream. The proxy stream keeps the historical name `PROXY_FIREHOSE`.

| Scope | Grants |
| - | - |
| `BASIC` | `GET /lookup/ip/{ip}`, `POST /lookup/ips`, `GET /lookup/domain/{domain}`, `GET /account/me` |
| `PROXY_FEEDS` | `proxies` Parquet exports |
| `PROXY_FIREHOSE` | `proxies` live stream |
| `ANONYMIZERS_FEED` / `ANONYMIZERS_STREAM` | Anonymizer exports / stream |
| `TORRENTS_FEED` / `TORRENTS_STREAM` | Torrent exports / stream |
| `HONEYPOT_HTTP_FEED` / `HONEYPOT_HTTP_STREAM` | Helios HTTP exports / stream |
| `HONEYPOT_HTTPS_FEED` / `HONEYPOT_HTTPS_STREAM` | Helios TLS ClientHello exports / stream |
| `HONEYPOT_DNS_FEED` / `HONEYPOT_DNS_STREAM` | Helios DNS exports / stream |
| `HONEYPOT_ADB_FEED` / `HONEYPOT_ADB_STREAM` | Helios Android Debug Bridge exports / stream |

Calling an endpoint the key is not scoped for returns `403 Forbidden`. Scopes cannot be self-granted; the account owner requests them from Synthient support.

Key handling rules to apply in generated code: read from an environment variable or secret manager, use a separate key per environment, never expose a key to a browser, and rotate immediately if a key may have been logged or committed.

## Lookup API

### GET /api/v4/lookup/ip/{ip}

Enriches one IPv4 or IPv6 address. Costs 1 credit. Requires `BASIC`.

Path parameter `ip`: the address to look up.

Response:

| Field | Type | Description |
| - | - | - |
| `ip` | string | The address that was queried |
| `network` | object | Network ownership |
| `network.asn` | integer | Autonomous System Number, `0` when the IP is not in BGP |
| `network.isp` | string | Internet service provider name |
| `network.type` | string | Network classification, see Enumerations |
| `network.org` | string \| null | Owning organization when distinct from the ISP |
| `network.domain` | string \| null | Primary domain of the network owner |
| `network.abuse_email` | string \| null | Abuse reporting email |
| `network.abuse_phone` | string \| null | Abuse reporting phone |
| `location` | object | Geolocation |
| `location.country` | string | ISO 3166-1 alpha-2 country code |
| `location.state` | string | Region or state code |
| `location.city` | string | City name |
| `location.timezone` | string | IANA time zone identifier |
| `location.latitude` | number | Latitude |
| `location.longitude` | number | Longitude |
| `location.geo_hash` | string | Geohash for coarse grouping |
| `intelligence` | object | Risk signals and attribution |
| `intelligence.risk_score` | integer | 0-100 likelihood the IP is used for malicious activity |
| `intelligence.behavior` | array\<string> | Behaviors observed in a 90 day window, open set |
| `intelligence.categories` | array\<string> | Anonymization categories, open set |
| `intelligence.devices` | array\<object> | Device signatures seen behind the IP |
| `intelligence.devices[].os` | string | Operating system, see Enumerations |
| `intelligence.devices[].version` | string | OS version when available |
| `intelligence.devices[].last_seen` | integer | Unix **seconds** the signature was last observed |
| `intelligence.providers` | array\<object> | Proxy, VPN, and anonymizer attribution |
| `intelligence.providers[].provider` | string | Provider tag, see Service tags |
| `intelligence.providers[].type` | string | Signal type from that provider, see Enumerations |
| `intelligence.providers[].last_seen` | integer | Unix **seconds** the signal was last observed |

An empty `providers` array means no proxy or VPN attribution, not that the IP is clean: check `behavior` and `network.type` as well.

```bash
curl -G https://api.synthient.com/api/v4/lookup/ip/101.53.218.152 \
  -H "x-api-key: $SYNTHIENT_API_KEY"
```

```json
{
  "ip": "101.53.218.152",
  "network": {
    "asn": 55850,
    "isp": "TrustPower Ltd",
    "type": "RESIDENTIAL",
    "org": null,
    "domain": null,
    "abuse_email": null,
    "abuse_phone": null
  },
  "location": {
    "country": "NZ",
    "state": "CAN",
    "city": "New Brighton",
    "timezone": "Pacific/Auckland",
    "latitude": -43.532,
    "longitude": 172.341,
    "geo_hash": "rb6"
  },
  "intelligence": {
    "risk_score": 96,
    "behavior": ["PROGRAMMATIC_TRAFFIC"],
    "categories": ["RESIDENTIAL_PROXY"],
    "devices": [],
    "providers": [
      { "provider": "LUNAPROXY", "type": "RESIDENTIAL_PROXY", "last_seen": 1776729600 },
      { "provider": "BRIGHTDATA", "type": "RESIDENTIAL_PROXY", "last_seen": 1777248000 }
    ]
  }
}
```

Failure bodies for this endpoint: `400` `{"title": "Validation error", "errors": {"ip_address": ["must be a valid IP address"]}}`, `401` `{"detail": "Invalid API Key"}`, `402` `{"detail": "Quota exhausted"}`, `500` `{"detail": "Internal Server Error"}`.

### POST /api/v4/lookup/ips

Enriches up to 1,000 addresses in one request. Costs `ceil(n * 0.9)` credits where `n` is the number of unique valid addresses in the body, a 10% batch discount. Duplicates and invalid entries are stripped before charging. Requires `BASIC`.

Request body: `{"ips": ["8.8.8.8", "1.1.1.1"]}`, an array of up to 1,000 IPv4 or IPv6 addresses.

Response: `{"results": [...]}` where each element has the same shape as a single lookup.

```bash
curl https://api.synthient.com/api/v4/lookup/ips \
  -H "x-api-key: $SYNTHIENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ips": ["8.8.8.8", "1.1.1.1", "101.53.218.152"]}'
```

More than 1,000 entries returns `400` with `{"title": "Validation error", "errors": {"ips": ["must contain at most 1000 entries"]}}`. Chunk larger workloads client-side.

### GET /api/v4/lookup/domain/{domain}

Returns honeypot intelligence collected for a domain by the Helios sensor mesh: aggregate counts, a daily time series, top subdomains and ports, and a capped sample of recent events. Costs 1 credit. Requires `BASIC`.

Path parameter `domain`: the domain to look up, such as `google.com`.

Response:

| Field | Type | Description |
| - | - | - |
| `type` | string | Always `"domain"` |
| `data.domain` | string | The domain queried |
| `data.status` | string | `ok`, `dormant`, or `unknown` |
| `data.stats.events_24h` | integer | Honeypot events in the last 24 hours |
| `data.stats.total_events_30d` | integer | Honeypot events in the last 30 days |
| `data.time_series` | array\<object> | Per-day counts, oldest first |
| `data.time_series[].date` | string | UTC date as `YYYY-MM-DD` |
| `data.time_series[].events` | integer | Events observed that day |
| `data.top_subdomains` | array\<object> | Most active subdomains first |
| `data.top_subdomains[].subdomain` | string | Fully qualified subdomain |
| `data.top_subdomains[].count` | integer | Events for that subdomain |
| `data.top_ports` | array\<object> | Most frequent destination ports |
| `data.top_ports[].port` | integer | Destination port |
| `data.top_ports[].count` | integer | Events on that port |
| `data.recent_events` | array\<object> | Capped sample of recent events |
| `data.recent_events[].timestamp` | integer | Unix **seconds** of the event |
| `data.recent_events[].source_ip_masked` | string | Source IP with the host portion masked, such as `203.0.113.x` |
| `data.recent_events[].target_subdomain` | string | Subdomain targeted |
| `data.recent_events[].port` | integer | Destination port hit |

`recent_events` is a sample capped server-side. For full history, pull the Helios Parquet exports rather than paging this endpoint.

```json
{
  "type": "domain",
  "data": {
    "domain": "example.com",
    "status": "ok",
    "stats": { "events_24h": 142, "total_events_30d": 8910 },
    "time_series": [{ "date": "2026-05-02", "events": 142 }],
    "top_subdomains": [{ "subdomain": "login.example.com", "count": 4521 }],
    "top_ports": [{ "port": 443, "count": 6201 }],
    "recent_events": [
      { "timestamp": 1777818121, "source_ip_masked": "203.0.113.x", "target_subdomain": "login.example.com", "port": 443 }
    ]
  }
}
```

## Account API

### GET /api/v4/account/me

Returns the account behind the key, its scopes, and its remaining quota. Free. Requires `BASIC`. Rate limited to 10 req/sec.

| Field | Type | Description |
| - | - | - |
| `first_name` | string | Account owner first name |
| `last_name` | string | Account owner last name |
| `email` | string | Account owner email |
| `organization.id` | string | Organization identifier |
| `organization.name` | string | Organization display name |
| `organization.relation` | string | `OWNER`, `ADMIN`, or `MEMBER` |
| `scopes` | array\<string> | Scopes granted to this key |
| `lookup_quota.credits` | integer | Lookup credits remaining |
| `lookup_quota.resets_in` | integer | Seconds until the balance refills |

```json
{
  "first_name": "Ada",
  "last_name": "Lovelace",
  "email": "ada@example.com",
  "organization": { "id": "org_01J5XK2ZQ8R6VBT3WE6E7C9D2H", "name": "Analytical Engine, Inc.", "relation": "OWNER" },
  "scopes": ["BASIC", "PROXY_FEEDS", "PROXY_FIREHOSE", "ANONYMIZERS_FEED"],
  "lookup_quota": { "credits": 982341, "resets_in": 1893456 }
}
```

Poll this on a schedule to alert on credit burn rate. Do not poll it per request.

## Feed exports

Every stream is published as Parquet snapshots: one per hour, rolled up daily. Snapshots are served as presigned R2 URLs valid for 24 hours, with size, row count, SHA-256 checksum, and the Parquet schema available separately. Exports do not consume lookup credits; they are gated by the `*_FEED` scope.

Seven stream identifiers are shared by exports and streams:

| Identifier | Contents |
| - | - |
| `proxies` | Proxy IP observations: residential, datacenter, mobile |
| `anonymizers` | VPN, Tor, and relay-class ranges |
| `torrents` | DHT and tracker peer sightings with info hash and metadata |
| `honeypot_http` | HTTP request captures from Helios sensors |
| `honeypot_https` | TLS ClientHello captures from Helios sensors |
| `honeypot_dns` | DNS resolution observations from Helios tunnels |
| `honeypot_adb` | Android Debug Bridge shell commands captured by Helios |

Snapshot lifecycle: hourly snapshots are addressable at `/export/{date}/{hour}` for the **current UTC date only**. At 00:30 UTC the previous day's hourlies are rolled into the daily snapshot at `/export/{date}` and the per-hour artifacts are deleted. The identifier `latest` always resolves to the most recent hourly.

Helios paths: the four honeypot feeds are also addressable under a `helio/` URL prefix, for example `/api/v4/feeds/helio/http/export/{date}` and `/api/v4/feeds/helio/https/export/{date}`. The snapshot listing endpoint reports them under the `honeypot_http`, `honeypot_https`, `honeypot_dns`, and `honeypot_adb` identifiers. Same data, two spellings.

### GET /api/v4/feeds/{stream}/export

One page of available snapshots, newest first, capped at 500 rows.

Query parameters: `limit` (default `100`, values above `500` are clamped) and `cursor` (opaque token from `next_cursor`, omitted on the first page).

| Field | Type | Description |
| - | - | - |
| `stream` | string | Stream identifier |
| `feeds` | array\<object> | Page of snapshots, newest first |
| `feeds[].kind` | string | `hourly` or `daily` |
| `feeds[].date` | string | UTC `YYYY-MM-DD` |
| `feeds[].hour` | integer | `0`-`23`, omitted on daily rollups |
| `feeds[].size_bytes` | integer | Parquet file size |
| `feeds[].row_count` | integer | Rows in the file |
| `feeds[].checksum` | string | Hex SHA-256 of the file bytes |
| `feeds[].id` | string | `YYYY-MM-DD`, `YYYY-MM-DD/HH`, or `latest` |
| `feeds[].created_at` | integer | Unix **seconds** the snapshot was indexed |
| `feeds[].download_path` | string | Relative path to follow for the download redirect |
| `next_cursor` | string | Pagination token, absent on the final page |

```bash
curl -G https://api.synthient.com/api/v4/feeds/proxies/export \
  -H "x-api-key: $SYNTHIENT_API_KEY" \
  --url-query "limit=50"
```

Paginate by passing `next_cursor` back as `cursor` until the field is absent. Cursors are opaque: do not construct or mutate them.

### GET /api/v4/feeds/{stream}/export/{id}

Returns `307` to a presigned R2 URL valid for 24 hours. The `307` is deliberate: the URL is minted per request and must not be cached by intermediaries. Follow the redirect to download the Parquet file. `{id}` is a `YYYY-MM-DD` date, `latest`, or `{date}/{hour}` for a specific hour in the current UTC day.

```bash
curl -L -o proxies.parquet \
  https://api.synthient.com/api/v4/feeds/proxies/export/latest \
  -H "x-api-key: $SYNTHIENT_API_KEY"
```

Verify the download against the `checksum` from the metadata endpoint before using it. Download is rate limited to 0.1 req/sec, roughly 360 per hour, shared across all feeds for the team.

### GET /api/v4/feeds/{stream}/export/{id}/meta

Metadata for one snapshot, including the Parquet schema, without downloading it.

| Field | Type | Description |
| - | - | - |
| `stream` | string | Stream identifier |
| `kind` | string | `hourly` or `daily` |
| `hour` | integer | `0`-`23`, omitted on daily rollups |
| `id` | string | `YYYY-MM-DD`, `YYYY-MM-DD/HH`, or `latest` |
| `format` | string | Always `"parquet"` |
| `date` | integer | Unix **seconds** for the snapshot instant, midnight UTC for dailies |
| `created_at` | integer | Unix **seconds** the snapshot was indexed |
| `size` | integer | File size in bytes |
| `rows` | integer | Row count |
| `checksum` | string | Hex SHA-256 of the file bytes |
| `schema.fields` | array\<object> | One entry per Parquet column |
| `schema.fields[].name` | string | Column name |
| `schema.fields[].type` | string | `string`, `int64`, `uint32`, `uint64`, `bool`, or `bytes` |

```json
{
  "stream": "proxies",
  "kind": "hourly",
  "hour": 22,
  "id": "latest",
  "format": "parquet",
  "date": 1778191200,
  "created_at": 1778195206,
  "size": 620273951,
  "rows": 43141039,
  "checksum": "fd6c002ad6c6ae73344c2fdf1cb535a303d90edf9252358e0d30a44231649d36",
  "schema": {
    "fields": [
      { "name": "ip", "type": "string" },
      { "name": "provider", "type": "string" },
      { "name": "type", "type": "string" },
      { "name": "timestamp", "type": "int64" },
      { "name": "country_code", "type": "string" },
      { "name": "asn", "type": "uint32" }
    ]
  }
}
```

Snapshots are large. The `proxies` hourly above is 620 MB and 43 million rows; a daily rollup can exceed 14 GB and a billion rows. Stream them to disk, never into memory.

## Real-time streams

Each stream is a long-lived HTTP response carrying newline-delimited JSON: one complete JSON object per line, no wrapper array, no server-sent-event framing. Streams are free of lookup credits and gated by the `*_STREAM` scope (`PROXY_FIREHOSE` for proxies).

Connection behavior that generated code must handle: the server closes healthy connections about every 30 minutes. Reconnect immediately. Apply exponential backoff with jitter only when the reconnect itself fails. Connection establishment is rate limited to 0.5 req/sec with a burst of 20, shared across all seven feeds for the team; established connections are not re-charged.

| Stream | Endpoint |
| - | - |
| Proxies | `GET /api/v4/feeds/proxies/stream` |
| Anonymizers | `GET /api/v4/feeds/anonymizers/stream` |
| Torrents | `GET /api/v4/feeds/torrents/stream` |
| Helios HTTP | `GET /api/v4/feeds/helio/http/stream` |
| Helios TLS | `GET /api/v4/feeds/helio/https/stream` |
| Helios DNS | `GET /api/v4/feeds/helio/dns/stream` |
| Helios ADB | `GET /api/v4/feeds/helio/adb/stream` |

Honeypot streams are addressed under the `helio/` prefix, never as `/feeds/honeypot_http/stream`. The `honeypot_*` spelling is what the snapshot listing endpoint uses.

### Proxy events

Unix **seconds**.

| Field | Type | Description |
| - | - | - |
| `ip` | string | Proxy IPv4 or IPv6 address |
| `provider` | string | Provider tag, such as `BRIGHTDATA` |
| `type` | string | `RESIDENTIAL_PROXY`, `DATACENTER_PROXY`, `MOBILE_PROXY`, and others |
| `timestamp` | integer | Unix seconds of the observation |
| `country_code` | string | ISO 3166-1 alpha-2 |
| `asn` | integer | Autonomous System Number |

```json
{"ip":"38.238.45.9","provider":"DATAIMPULSE","type":"RESIDENTIAL_PROXY","timestamp":1762605697,"country_code":"US","asn":174}
```

### Anonymizer events

Anonymizers are emitted as ranges, not single addresses. A single-address observation has `range_start` equal to `range_end`. Unix **seconds**.

| Field | Type | Description |
| - | - | - |
| `range_start` | string | First IP in the range |
| `range_end` | string | Last IP in the range |
| `provider` | string | Provider tag, such as `NORDVPN`, `TOR`, `APPLE` |
| `type` | string | `COMMERCIAL_VPN`, `TOR_NODE`, `PRIVATE_RELAY`, and others |
| `timestamp` | integer | Unix seconds of the observation |

```json
{"range_start":"172.224.224.0","range_end":"172.224.231.255","provider":"APPLE","type":"PRIVATE_RELAY","timestamp":1762605731}
```

### Torrent events

Unix **seconds**.

| Field | Type | Description |
| - | - | - |
| `info_hash` | string | 40 character hex SHA-1 info hash |
| `name` | string | Torrent name from metadata |
| `magnet_uri` | string | Magnet URI |
| `total_size` | integer | Total size of all files in bytes |
| `piece_length` | integer | Piece length in bytes |
| `file_count` | integer | Number of files |
| `files` | array\<object> | Per file `path` and `length` in bytes |
| `peers` | array\<object> | Observed peers: `ip`, `port`, `source`, `encrypted` |
| `peers[].source` | string | `DHT`, `PEX`, or `tracker` |
| `peers[].encrypted` | boolean | Whether the peer connection was encrypted |
| `timestamp` | integer | Unix seconds of the observation |

### Helios HTTP events

Unix **milliseconds**.

| Field | Type | Description |
| - | - | - |
| `timestamp` | integer | Unix milliseconds of capture |
| `domain` | string | Domain the request targeted |
| `port` | integer | Destination port |
| `tunnel_id` | integer | Sensor tunnel identifier |
| `protocol` | string | Captured protocol |
| `details.method` | string | HTTP method |
| `details.uri` | string | Request URI |
| `details.version` | string | HTTP version, such as `HTTP/1.1` |
| `details.headers` | object | Request headers, keys preserve the client's casing |
| `raw` | string | Raw HTTP request bytes |
| `meta` | object | Source metadata: `pool_id`, `provider`, `proxy_ip`, `server` as `host:port` |

The `meta` block attributes attacker traffic to the proxy exit it traversed, which is what lets you correlate honeypot activity with the proxy feeds.

### Helios TLS events

Unix **milliseconds**. Captures the ClientHello from TLS terminators on port 443.

| Field | Type | Description |
| - | - | - |
| `timestamp` | integer | Unix milliseconds of capture |
| `domain` | string | SNI domain |
| `port` | integer | Destination port |
| `tunnel_id` | integer | Sensor tunnel identifier |
| `protocol` | string | Captured protocol |
| `meta` | object | `proxy_ip`, `server`, `pool_id`, `provider` |
| `details` | object \| null | Parsed ClientHello, `null` only when parsing failed |
| `raw` | null | Always null on the stream; raw bytes are in the Parquet exports only |

`details` keys: `record_version`, `handshake_version`, `client_random`, `session_id`, `session_id_length`, `cipher_suites` (each `{code, name}`), `compression_methods`, `sni`, `supported_versions`, `supported_groups`, `ec_point_formats`, `signature_algorithms`, `extensions` (each `{code, name, length}`), `key_share_groups`, `psk_key_exchange_modes`, plus boolean flags `extended_master_secret`, `renegotiation_info`, `status_request`, `signed_certificate_timestamps`, `has_grease`, `encrypt_then_mac`, `post_handshake_auth`, `delegated_credentials`, `application_settings`.

Always null-check `details` before dereferencing it.

### Helios DNS events

Unix **milliseconds**.

| Field | Type | Description |
| - | - | - |
| `timestamp` | integer | Unix milliseconds of the observation |
| `tunnel_id` | integer | Sensor tunnel identifier |
| `domain` | string | Hostname queried |
| `port` | integer | Destination port of the tunnelled flow |
| `meta` | object | `proxy_ip`, `server`, `pool_id`, `provider` |

```json
{"timestamp":1762605697000,"tunnel_id":42,"domain":"c2.example.com","port":443,"meta":{"proxy_ip":"203.0.113.42","server":"hp-04","pool_id":"pool-us-east","provider":"BRIGHTDATA"}}
```

### Helios ADB events

Android Debug Bridge shell commands captured on port 5555.

| Field | Type | Description |
| - | - | - |
| `session` | string | Session hash grouping commands from one connection |
| `sequential_id` | integer | Monotonic event id within a session |
| `command` | string | Shell command bytes serialized as a JSON string |
| `hash` | string | SHA-256 of the command bytes, stable across sessions |

Deduplicate by `hash` when counting distinct attacker behavior; the same payload recurs across thousands of sessions.

### Minimal consumer

```python
import json, os, random, time, requests

URL = "https://api.synthient.com/api/v4/feeds/proxies/stream"
HEADERS = {"x-api-key": os.environ["SYNTHIENT_API_KEY"]}

delay = 1.0
while True:
    try:
        with requests.get(URL, headers=HEADERS, stream=True, timeout=(10, 90)) as r:
            r.raise_for_status()
            delay = 1.0
            for line in r.iter_lines():
                if line:
                    event = json.loads(line)
                    handle(event)
        continue  # clean close after ~30 minutes: reconnect immediately
    except requests.RequestException:
        time.sleep(delay * random.uniform(0.75, 1.25))
        delay = min(delay * 2, 60)
```

## Enumerations

`intelligence.categories` and the `type` field on providers, proxy events, and anonymizer events draw from this set. It grows over time.

| Value | Meaning |
| - | - |
| `FREE_VPN` | Free VPN service |
| `COMMERCIAL_VPN` | Commercial VPN service |
| `ENTERPRISE_VPN` | Enterprise VPN appliance such as SonicWall |
| `MOBILE_PROXY` | Proxy on a mobile carrier network |
| `BLOCKCHAIN_PROXY` | Decentralized or blockchain-based proxy |
| `RESIDENTIAL_PROXY` | Proxy running on residential addresses |
| `PUBLIC_PROXY` | Open proxy accessible to anyone |
| `DATACENTER_PROXY` | Proxy hosted in a datacenter |
| `TOR_NODE` | Tor exit node |
| `PRIVATE_RELAY` | Anonymizing relay such as iCloud Private Relay |
| `BOTNET` | Host participating in a known botnet |
| `SEARCH_ENGINE` | Verified search crawler such as Googlebot |
| `AI_CRAWLER` | AI training or retrieval crawler such as GPTBot |
| `SOCIAL_MEDIA` | Social platform fetcher such as Twitterbot |
| `UPTIME_MONITOR` | Uptime or synthetic monitoring service |
| `LINK_PREVIEW` | Link unfurler such as Slackbot or Discordbot |
| `SEO_CRAWLER` | SEO or marketing intelligence crawler |
| `WEB_ARCHIVER` | Archiving crawler such as the Internet Archive |
| `WEBHOOK_PROVIDER` | Outbound webhook delivery service |
| `PAYMENT_PROCESSOR` | Payment processor or fraud platform infrastructure |

The last nine values are benign automation. Blocking them is usually a bug: a `SEARCH_ENGINE` or `PAYMENT_PROCESSOR` hit is expected traffic, not abuse.

`network.type`:

| Value | Meaning |
| - | - |
| `MOBILE` | Mobile or cellular network |
| `SATELLITE` | Satellite internet |
| `IN_FLIGHT_WIFI` | In-flight airplane Wi-Fi |
| `RESIDENTIAL` | Residential broadband ISP |
| `CORPORATE` | Corporate or enterprise network |
| `ACADEMIC` | Academic or institutional network |
| `DATACENTER` | Datacenter infrastructure |
| `GOVERNMENT` | Government owned network |

`intelligence.behavior`, covering a 90 day window. Updated frequently; treat as an open list of strings.

| Value | Meaning |
| - | - |
| `PROGRAMMATIC_TRAFFIC` | Automated requests from HTTP clients or libraries such as curl |
| `ACTIVE_CRAWLER` | High volume requests consistent with crawling or scraping |
| `TORRENTING` | Peer-to-peer file sharing |
| `TOR_USER` | Connections observed to Tor entry nodes |
| `CREDENTIAL_STUFFING` | Rapid or repeated failed logins |
| `COMPROMISED_DEVICE` | Activity from devices infected with malware |
| `MALICIOUS_TRAFFIC` | Traffic patterns indicative of abuse |

`intelligence.devices[].os`: `ANDROID`, `IOS`, `WINDOWS`, `MACOS`, `LINUX`, `CHROME_OS`, `SMART_TV`, `GAME_CONSOLE`, `OTHER`. Device data comes from third party sources and is absent for many addresses.

## Errors

Content type is always `application/json`. Two body shapes:

```json
{ "detail": "Invalid API Key" }
```

```json
{ "title": "Validation error", "errors": { "ip_address": ["must be a valid IP address"] } }
```

Feed endpoints may instead return a problem-details body: `{"type": "...", "title": "Forbidden", "status": 403, "detail": "Insufficient scope for this resource"}`.

An empty body is a transient infrastructure error. Retry it.

| Status | Meaning | Action |
| - | - | - |
| `400` | Malformed IP, bad cursor, oversized batch | Fix the request. The body names the field. Do not retry unchanged |
| `401` | Missing or invalid `x-api-key` | Check the key is loaded and not truncated |
| `402` | Lookup credits exhausted | Add credits or wait for `lookup_quota.resets_in`. Streams and exports still work |
| `403` | Key lacks the scope for this endpoint | Check `scopes` on `/account/me`, request the scope |
| `404` | Snapshot, domain, or resource absent | Do not retry |
| `429` | Rate limit or concurrent stream limit | Back off, honor `Retry-After` |
| `500` | Server error | Retry with backoff |
| `503` | Streaming or downstream backend down | Retry with backoff and jitter |

## Rate limits and credits

Two independent systems: lookup credits meter the synchronous lookups, and request-rate limits apply to every endpoint. Both are per team, so multiple keys in one organization share the buckets.

Credit costs:

| Endpoint | Cost |
| - | - |
| `GET /lookup/ip/{ip}` | 1 credit |
| `POST /lookup/ips` | `ceil(n * 0.9)` credits for `n` unique valid IPs |
| `GET /lookup/domain/{domain}` | 1 credit |
| Feed exports | Free, counted against the feed subscription |
| Feed streams | Free, counted against the concurrent stream allowance |

100 IPs individually cost 100 credits; as a batch they cost 90. 1,000 IPs cost 900.

Request rates:

| Endpoint | Sustained | Burst |
| - | - | - |
| `GET /lookup/ip/{ip}` and `POST /lookup/ips` | 100 req/sec | 200 |
| `GET /lookup/domain/{domain}` | 100 req/sec | 200 |
| `GET /account/me` | 10 req/sec | 10 |
| `GET /feeds/{stream}/stream` connection setup | 0.5 req/sec | 20 |
| `GET /feeds/{stream}/export` and `.../meta` | 2 req/sec | 60 |
| `GET /feeds/{stream}/export/{id}` downloads | 0.1 req/sec | 120 |

Stream and export buckets are shared across all seven feeds. Fanning out to every stream does not multiply the budget.

Every rate-limited response carries the IETF headers `RateLimit-Limit` (bucket size), `RateLimit-Remaining` (tokens left), and `RateLimit-Reset` (seconds to full refill). Pace off these instead of probing for `429`.

Backoff recipe for `429`, `500`, and `503`: start at 1 second, double each failure, cap at 60 seconds, add ±25% jitter so concurrent workers do not synchronize, and give up after 5 to 8 attempts. Honor `Retry-After` when present.

```python
import os, random, time, requests

URL = "https://api.synthient.com/api/v4/lookup/ip/8.8.8.8"
HEADERS = {"x-api-key": os.environ["SYNTHIENT_API_KEY"]}

def lookup_with_retry(max_attempts: int = 6):
    for attempt in range(max_attempts):
        r = requests.get(URL, headers=HEADERS, timeout=10)
        if r.status_code < 400:
            return r.json()
        if r.status_code in (429, 500, 502, 503, 504):
            retry_after = int(r.headers.get("Retry-After", 0))
            base = max(retry_after, min(60, 2 ** attempt))
            time.sleep(base * random.uniform(0.75, 1.25))
            continue
        r.raise_for_status()
    raise RuntimeError("max retries exceeded")
```

Worth instrumenting: per-status counters (a rising `429` rate means batch or cache), actual backoff durations, and `lookup_quota.credits` as a burn-rate gauge rather than a zero alarm.

## gRPC

A strongly typed mirror of the HTTP API. Every lookup, export, and stream is an RPC on `synthient.v1.SynthientService` at `grpc.synthient.com:443` over TLS with a public CA certificate.

Do not use `api.synthient.com` or port `50051` for gRPC; the internal port is not exposed.

The schema is served by gRPC server reflection. There is no `.proto` bundle to download or vendor: any reflection-aware client discovers methods, messages, and field numbers at runtime.

```bash
grpcurl -H "x-api-key: $SYNTHIENT_API_KEY" grpc.synthient.com:443 list
grpcurl -H "x-api-key: $SYNTHIENT_API_KEY" grpc.synthient.com:443 describe synthient.v1.SynthientService
```

Generate clients from reflection with buf: `buf build --schema-from-reflection grpc.synthient.com:443` produces a `FileDescriptorSet` any codegen plugin can consume, and re-exporting to `.proto` is supported for toolchains that need files.

| HTTP | gRPC method |
| - | - |
| `GET /api/v4/account/me` | `GetAccountInfo` |
| `GET /api/v4/lookup/ip/{ip}` | `LookupIP` |
| `POST /api/v4/lookup/ips` | `LookupIPs` |
| `GET /api/v4/lookup/domain/{domain}` | `LookupDomain` |
| `GET /api/v4/feeds/{stream}/export` | `ListExportSnapshots` |
| `GET /api/v4/feeds/{stream}/export/{date}` | `GetExportSnapshotURL` |
| `GET /api/v4/feeds/{stream}/export/{date}/meta` | `GetExportSnapshotMeta` |
| `GET /api/v4/feeds/proxies/stream` | `StreamProxies`, server streaming |
| `GET /api/v4/feeds/anonymizers/stream` | `StreamAnonymizers`, server streaming |
| `GET /api/v4/feeds/torrents/stream` | `StreamTorrents`, server streaming |
| `GET /api/v4/feeds/helio/http/stream` | `StreamHoneypotHTTP`, server streaming |
| `GET /api/v4/feeds/helio/https/stream` | `StreamHoneypotHTTPS`, server streaming |
| `GET /api/v4/feeds/helio/dns/stream` | `StreamHoneypotDNS`, server streaming |
| `GET /api/v4/feeds/helio/adb/stream` | `StreamHoneypotADB`, server streaming |

`GetAccountInfo` works for any key, which makes it the cheapest probe for confirming auth.

Timestamps that are Unix integers on HTTP are `google.protobuf.Timestamp` on gRPC: RFC 3339 strings under protojson, `{seconds, nanos}` under proto3 binary.

| HTTP status | gRPC status |
| - | - |
| `400` | `INVALID_ARGUMENT` |
| `401` | `UNAUTHENTICATED` |
| `403` | `PERMISSION_DENIED` |
| `404` | `NOT_FOUND` |
| `429` | `RESOURCE_EXHAUSTED`, carries `retry-after` metadata |
| `500` | `INTERNAL` |
| `503` | `UNAVAILABLE` |

Read `retry-after` from the trailing metadata on `RESOURCE_EXHAUSTED` and back off with the same recipe as HTTP.

## Go SDK

`github.com/synthient/go-synthient/v2`, open source, reference docs on pkg.go.dev. Requires Go 1.25 or later; streams use `iter.Seq2`, available since Go 1.23.

```bash
go get -u github.com/synthient/go-synthient/v2
```

```go
client := synthient.NewClient(os.Getenv("SYNTHIENT_API_KEY"))

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
opts := &synthient.RequestOptions{Context: ctx}
```

Every method takes a trailing `*synthient.RequestOptions`; pass `nil` for defaults.

| Method | Purpose |
| - | - |
| `GetIP(ip, opts)` | Enrich one address |
| `GetIPs(ips, opts)` | Batch enrich |
| `GetDomain(domain, opts)` | Domain intelligence |
| `GetAccount(opts)` | Account, scopes, quota |
| `FeedSnapshots(stream, opts)` | Page snapshots, newest first |
| `FeedSnapshotMeta(stream, date, opts)` | Checksum, rows, size, Parquet schema. `date` accepts `latest`, `YYYY-MM-DD`, `YYYY-MM-DD/HH` |
| `DownloadFeedSnapshot(stream, date, hour, opts)` | Follows the redirect, returns a reader the caller closes |
| `DownloadProxy`, `DownloadAnonymizer`, `DownloadTorrent`, `DownloadHeliosHTTP`, `DownloadHeliosTLS` | Per-feed wrappers taking `(date, hour, filename, opts)`; a non-empty filename writes straight to disk |
| `StreamProxy`, `StreamAnonymizer`, `StreamTorrent`, `StreamHeliosHTTP`, `StreamHeliosTLS` | `iter.Seq2` yielding one event per NDJSON line |
| `GRPCSchema(ctx, symbols)` | Protobuf descriptors over reflection; `nil` resolves every service |
| `ExplainGRPCError`, `NormalizeGRPCEndpoint` | Transport error messages and endpoint parsing |

```go
for event, err := range client.StreamProxy(nil) {
    if err != nil {
        log.Fatal(err)
    }
    fmt.Println(event.IP, event.Provider, event.CountryCode)
}
```

Stream payloads match the HTTP event schemas field for field. Helios TLS events carry a nil-able `Details`, so check it before use.

## CLI

One binary covering account status, lookups, snapshots, streams, and schemas. Human-readable output on a terminal, `json` / `csv` / NDJSON when piped. Production endpoints are compiled in, so no configuration is needed for normal use.

```bash
brew install synthient/tap/synthient
# or
go install github.com/synthient/cli/cmd/synthient@latest
```

Credentials resolve first-match-wins: `SYNTHIENT_API_KEY`, then a `.env` in the working directory, then the OS keychain populated by `synthient auth`. `synthient status` reports which source is active without printing the secret.

```txt
synthient
  auth                 Store or remove an API key in the OS keychain
  status               Config, auth source, endpoint, quota, and scope status
  account              Account, scope, and quota details
  scopes               Which scopes the active key holds
  lookup               IP intelligence: one IP, many IPs, or stdin
  lookup domain        Domain intelligence from Helios observations
  feeds streams        List supported feed streams
  feeds snapshots      List daily and hourly Parquet snapshots
  feeds meta|schema    Snapshot metadata and Parquet schema
  feeds checksum       Expected SHA-256 for a snapshot
  feeds download       Download a snapshot to a Parquet file
  download             Shorthand wrapper around feeds download
  stream               Stream live NDJSON feed events
  grpc schema          Output protobuf descriptors via gRPC reflection
  mcp                  Run a Model Context Protocol server over stdio
```

```bash
synthient lookup 8.8.8.8 1.1.1.1 --format json
synthient feeds snapshots proxies --limit 10
synthient feeds download proxies latest proxies.parquet --verify
synthient stream proxies --filter type=RESIDENTIAL_PROXY --duration 5s
synthient grpc schema synthient.v1.SynthientService
```

`stream` has no `--format`: output is always NDJSON. Bound a run with `--max-events` or `--duration`, write to a file with `--output`, survive server-side closes with `--reconnect`, and narrow with repeatable `--filter field=value` (all must match, dot notation reaches nested fields, applied client-side after each event arrives). `--pretty` is for eyeballing only.

Global flags: `--config <path>`, `--profile <name>`, `--no-color`, `--quiet`, `--version`. A TOML config at `~/.config/synthient/config.toml` is needed only for custom endpoints or named profiles.

## MCP server

`synthient mcp` runs a Model Context Protocol server over stdio, exposing Synthient as tools for MCP-compatible clients. It uses the same credential order as the rest of the CLI and exits at startup if no key is found. The only flag is `--transport`, currently `stdio`.

| Tool | Purpose |
| - | - |
| `lookup_ip` | Intelligence for one or more IP addresses |
| `lookup_domain` | Domain intelligence from Helios observations |
| `get_account` | Organization, scopes, lookup quota |
| `list_feed_streams` | Available feed streams with descriptions and aliases |
| `list_feed_snapshots` | Parquet snapshots for a stream, paginated |
| `feed_snapshot_meta` | Snapshot metadata, checksum, size, row count, schema |
| `sample_stream` | Bounded sample of live events from a feed |
| `grpc_schema` | Protobuf descriptors through gRPC reflection |

```json
{ "mcpServers": { "synthient": { "command": "synthient", "args": ["mcp"] } } }
```

Prefer this over hand-rolled HTTP when the agent runtime supports MCP: it handles auth, pagination, and stream bounding for you.

## Migrating from other vendors

### From Spur

| Spur | Synthient |
| - | - |
| `ip` | `ip` |
| `as.number` | `network.asn` |
| `as.organization` | `network.isp` |
| `infrastructure` | `network.type` |
| `location.country` | `location.country` |
| `location.state` | `location.state` |
| `location.city` | `location.city` |
| `client.types` | `intelligence.devices[].os` |
| `client.count` | length of `intelligence.devices` |
| `risks` | `intelligence.behavior` |
| `services` | `intelligence.categories` |

Synthient adds `network.org`, `network.domain`, `network.abuse_email`, `network.abuse_phone`, `location.timezone`, `location.latitude`, `location.longitude`, `location.geo_hash`, and `intelligence.risk_score`, none of which have Spur equivalents.

### From IPQualityScore

| IPQS | Synthient |
| - | - |
| `ISP` | `network.isp` |
| `organization` | `network.org` |
| `ASN` | `network.asn` |
| `connection_type` | `network.type` |
| `host` | `network.domain` |
| `country_code` | `location.country` |
| `region` | `location.state` |
| `city` | `location.city` |
| `timezone` | `location.timezone` |
| `latitude` / `longitude` | `location.latitude` / `location.longitude` |
| `fraud_score` | `intelligence.risk_score` |
| `proxy`, `vpn`, `tor` | `intelligence.providers[].type` |
| `active_vpn`, `active_tor` | `intelligence.providers[].last_seen` |
| `is_crawler`, `bot_status`, `recent_abuse` | `intelligence.behavior` |
| `mobile`, `operating_system` | `intelligence.devices[].os` |
| `device_model` | `intelligence.devices[].version` |

The shape difference that matters: IPQS returns booleans, Synthient returns attributed evidence. `proxy: true` becomes a `providers` array naming which provider was seen and when, so you can weight a fresh `BRIGHTDATA` sighting differently from a six month old one.

## Risk scoring

`intelligence.risk_score` is built from behavioral data (device clustering from torrenting and browsing traffic), residential proxy, VPN, and other anonymization signals, and honeypot data (exploit scanning, credential stuffing, phishing).

Synthient's own guidance is that enterprise users should score internally rather than consume the number directly, for three reasons: use cases differ (stopping bot farms and mitigating DDoS want different weights, and some providers target some platforms harder than others), you have context Synthient does not, and one 0-100 number collapses independent signals that your engine could weigh separately.

Building your own:

- **Residential proxies** are short-lived and shared with legitimate users, which is the main source of false positives. Combine the firehose with an expiring cache: treat an IP as proxied only if it was observed within a recent window, commonly 5 to 10 minutes. Always corroborate with a second signal.
- **ISP and datacenter proxies** from the bulk feeds are used almost exclusively for automation. Treat them as high risk or outright block.
- **VPNs** are ambiguous and usually belong in a medium to high band, not an automatic block.
- **Device clustering** from third party browsing data reveals multiple devices or known-bad TLS fingerprints behind one address. It carries a penalty similar to residential proxy frequency.

## Recipes

**Enrich a batch and act on categories, not the score.**

```bash
curl https://api.synthient.com/api/v4/lookup/ips \
  -H "x-api-key: $SYNTHIENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ips": ["8.8.8.8", "1.1.1.1"]}' \
  | jq '.results[] | {ip, cats: .intelligence.categories, net: .network.type}'
```

`DATACENTER_PROXY` and `PUBLIC_PROXY` are safe to block outright: they exist for automation. `RESIDENTIAL_PROXY` deserves a recency check before blocking, since those addresses are shared with real users (see the live cache recipe below). `COMMERCIAL_VPN` belongs in step-up verification, not a hard block. `SEARCH_ENGINE`, `PAYMENT_PROCESSOR`, `UPTIME_MONITOR`, and the rest of the benign automation categories should be allowed; blocking them breaks indexing, payments, and monitoring.

**Keep a live proxy cache.** Consume `/feeds/proxies/stream`, insert each `ip` into a TTL cache of 5 to 10 minutes, and check membership at request time. This is the pattern that keeps residential proxy false positives low, because it answers "is this IP proxying right now" instead of "was it ever a proxy".

**Bulk analysis.** List snapshots, read the metadata for the checksum and schema, download the Parquet, verify, then query it with your engine of choice. Use `latest` for the newest hourly and a `YYYY-MM-DD` date for a daily rollup. Never load a snapshot into memory.

**Pre-flight a new integration.** Call `/account/me` first. Compare `scopes` against the endpoints you intend to call and fail fast with a clear message rather than surfacing a `403` at runtime.

## Pitfalls

- Helios stream timestamps are milliseconds. Everything else is seconds. Applying one conversion to both puts the Helios events tens of thousands of years in the future.
- `network.type` is the network classification, not a proxy verdict. `DATACENTER` alone does not mean abuse, and `RESIDENTIAL` does not mean safe: residential is exactly where residential proxies live.
- An empty `providers` array is not a clean bill of health. Check `behavior` and `categories`.
- Honeypot feeds answer to two spellings: `helio/http` in stream and export URLs, `honeypot_http` in the snapshot listing endpoint and in scope names. They are the same data.
- Only the current UTC date has hourly snapshots. Older hours are rolled up at 00:30 UTC and deleted.
- Presigned download URLs expire after 24 hours and are minted per request. Do not cache or share them.
- Rate limits are per team, not per key. Issuing a second key does not double throughput.
- A clean stream close after 30 minutes is normal. Treating it as an error and backing off will cost you data.
- The public service tag list is a floor. Tags classified TLP:AMBER+STRICT are shared only under MNDA, so a provider name you do not recognize may still be legitimate.
- gRPC is `synthient.v1` while HTTP is `/api/v4`. The mismatch is intentional.

## Service tags

Every observed IP is attributed to one or more service tags naming the proxy provider, VPN, or anonymization service. Tags appear in `intelligence.providers[].provider`, in the `provider` field on proxy and anonymizer events, and in the Parquet exports. Tags are stable uppercase identifiers.

The list below is the public set. It is a floor rather than a complete inventory: some tags are classified TLP:AMBER+STRICT and are shared only with specific organizations under MNDA. Do not treat an unfamiliar provider value as invalid.

- `2CAPTCHA`: 2Captcha
- `360PROXY`: 360Proxy
- `711PROXY`: 711Proxy
- `711PROXY_UNLIMITED`: 711Proxy Unlimited
- `911FO`: 911.fo
- `911FO_NETNUT`: 911.fo Netnut
- `911PROXY`: 911Proxy
- `911PROXY_UNLIMITED`: 911Proxy Unlimited
- `922PROXY`: 922Proxy
- `9PROXY`: 9Proxy
- `ABCPROXY`: ABCProxy
- `ACEPROXIES`: Aceproxies
- `ADGUARD_VPN`: AdGuard VPN
- `ALTV6_DATACENTER`: Altv6 Datacenter
- `ANYIP`: Anyip
- `ANYIP_MOBILE`: Anyip Mobile
- `ASOCKS`: Asocks
- `ASTRILL`: AstrillVPN
- `AUZMA`: Auzma
- `BARTPROXIES`: Bartproxies
- `BARTPROXIES_ISP`: Bartproxies ISP
- `BEEPROXY`: Beeproxy
- `BIRDPROXIES`: Birdproxies
- `BIRDPROXIES_PERFORMANCE`: Birdproxies Performance
- `BLURPATH`: Blurpath
- `BOTTINGTOOLS_BASIC`: Bottingtools Basic
- `BOTTINGTOOLS_ISP`: Bottingtools ISP
- `BOTTINGTOOLS_PREMIUM`: Bottingtools Premium
- `BRANDERGROUP_ISP`: Brandergroup ISP
- `BRIGHTDATA`: Bright Data
- `BRIGHTDATA_DATACENTER`: Bright Data Datacenter
- `BUDGETPROXY`: Budgetproxy
- `BYPASSPROXIES`: Bypassproxies
- `BYTEPROXIES`: Byteproxies
- `BYTEZERO`: Bytezero
- `CATPROXIES`: Catproxies
- `CHERRYPROXY`: Cherryproxy
- `CLEANLTE`: CleanLTE
- `CLOUDBYPASS`: Cloudbypass
- `CYBERGHOST`: CyberGhost
- `DATABAY`: Databay
- `DATAIMPULSE`: DataImpulse
- `DATAIMPULSE_PREMIUM`: DataImpulse Premium
- `DECODO`: Decodo
- `DIGIPROXY`: Digiproxy
- `DIGIPROXY_PREMIUM`: Digiproxy Premium
- `ECLIPSEPROXY`: Eclipseproxy
- `ENIGMAPROXY`: Enigmaproxy
- `ENIGMAPROXY_ENTERPRISE`: Enigmaproxy Enterprise
- `ENIGMAPROXY_PREMIUM`: Enigmaproxy Premium
- `EVOLVE`: Evolve
- `EVOMI_CORE`: Evomi Core
- `EVOMI_DATACENTER`: Evomi Datacenter
- `EVOMI_PREMIUM`: Evomi Premium
- `EXPRESSVPN`: ExpressVPN
- `FASTESTVPN`: FastestVPN
- `FASTVPN`: FastVPN
- `FLAMINGO_DELUXE`: Flamingo Deluxe
- `FLAMINGO_ENTERPRISE`: Flamingo Enterprise
- `FLAMINGO_ENTRY`: Flamingo Entry
- `FLAMINGO_SNEAKER`: Flamingo Sneaker
- `FLAMINGO_STANDARD`: Flamingo Standard
- `FLAMINGO_TICKET`: Flamingo Ticket
- `FLASHPROXY`: Flashproxy
- `FLASHPROXY_LITE`: Flashproxy Lite
- `FLOPPYDATA`: Floppydata
- `FLYPROXY`: Flyproxy
- `FREE_VPN_PLANET`: Free VPN Planet
- `FREEDOM_IP_VPN`: Freedom-IP-VPN
- `FROOTVPN`: FrootVPN
- `FROXY`: Froxy
- `GEONODE`: Geonode
- `GEONODE_DATACENTER`: Geonode Datacenter
- `GETGRASS`: GetGrass
- `GHOST_PATH_VPN`: Ghost Path VPN
- `GOOSEVPN`: GooseVPN
- `GOPROXIES`: GoProxies
- `GOPROXY`: GoProxy
- `HIDEME`: Hide.me
- `HOLA_VPN`: Hola VPN
- `HPROXY`: HProxy
- `HYDRAPROXY`: Hydraproxy
- `HYPEPROXIES_ISP`: Hypeproxies ISP
- `INFATICA`: Infatica
- `INFATICA_DATACENTER`: Infatica Datacenter
- `INFINITEPROXIES`: Infiniteproxies
- `IP2UP`: IP2Up
- `IP2WORLD`: IP2World
- `IPCOLA`: IPCola
- `IPCOLA_DATACENTER`: IPCola Datacenter
- `IPIDEA`: IPIDEA
- `IPIDEA_DATACENTER`: IPIDEA Datacenter
- `IPIDEA_ISP`: IPIDEA ISP
- `IPROYAL`: IPRoyal
- `IPROYAL_ISP`: IPRoyal ISP
- `IVACY`: Ivacy VPN
- `KOCERROXY`: Kocerroxy
- `KOCHSECRET`: Kochsecret
- `KOOKEEY`: Kookeey
- `LAVISHPROXIES`: Lavishproxies
- `LEMONBRIGHT`: Lemonbright
- `LEMONLABS`: Lemonlabs
- `LEMONLABS_ISP`: Lemonlabs ISP
- `LEMONLABS_MOBILE`: Lemonlabs Mobile
- `LEMONPRIME`: Lemonprime
- `LIGHTNINGPROXIES`: Lightningproxies
- `LIGHTNINGPROXIES_DATACENTER`: Lightningproxies Datacenter
- `LOCALPROXIES`: Localproxies
- `LUNAPROXY`: Lunaproxy
- `LUNAPROXY_ISP`: Lunaproxy ISP
- `MANGOPROXY`: Mangoproxy
- `MARSPROXY`: Marsproxy
- `MASKIFY`: Maskify
- `MASSIVE`: Massive
- `MINPROXY_DATACENTER`: Minproxy Datacenter
- `MIYAIP`: MiyaIP
- `MOMOPROXY`: Momoproxy
- `MULLVAD`: Mullvad
- `NAPROXY`: Naproxy
- `NETNUT`: NetNut
- `NETNUT_DATACENTER`: NetNut Datacenter
- `NETTIFY`: Nettify
- `NIMBLE`: Nimble
- `NIUPROXY`: Niuproxy
- `NODEMAVEN`: NodeMaven
- `NORDVPN`: NordVPN
- `NOVADA`: Novada
- `NOVADA_DATACENTER`: Novada Datacenter
- `OCULUSPROXIES`: Oculusproxies
- `OCULUSPROXIES_DATACENTER`: Oculusproxies Datacenter
- `OCULUSPROXIES_ISP`: Oculusproxies ISP
- `OCULUSPROXIES_SNEAKER`: Oculusproxies Sneaker
- `OCULUSPROXIES_TICKET`: Oculusproxies Ticket
- `OKKPROXY`: Okkproxy
- `OMEGACLOUD_DATACENTER`: Omegacloud Datacenter
- `OPERA_VPN`: Opera Free VPN Proxy
- `OVPN`: OVPN
- `OXYLABS`: Oxylabs
- `OXYLABS_DATACENTER`: Oxylabs Datacenter
- `OXYLABS_ISP`: Oxylabs ISP
- `PACKETSTREAM`: PacketStream
- `PERFECTPRIVACY`: PerfectPrivacy
- `PIAS5`: PIA S5
- `PINGPROXIES`: Pingproxies
- `PLAINPROXIES`: Plainproxies
- `PLAINPROXIES_DATACENTER`: Plainproxies Datacenter
- `PLAINPROXIES_UNLIMITED`: Plainproxies Unlimited
- `PLASMAPROXIES`: Plasmaproxies
- `PRIVADOVPN`: PrivadoVPN
- `PIA`: Private Internet Access
- `PRIVATETUNNEL`: PrivateTunnel
- `PRIVATEVPN`: PrivateVPN
- `PROXIDIZE`: Proxidize
- `PROXIESFO`: Proxiesfo
- `PROXIESFO_ATT`: Proxiesfo ATT
- `PROXIRA_PREMIUM`: Proxira Premium
- `PROXIWARE`: Proxiware
- `PROXY6_DATACENTER`: Proxy6 Datacenter
- `PROXYBOX`: Proxybox
- `PROXYCAKE_ELITE`: Proxycake Elite
- `PROXYCAKE_PRIVATE`: Proxycake Private
- `PROXYCAKE_STARTER`: Proxycake Starter
- `PROXYEMPIRE`: ProxyEmpire
- `PROXYHEAVEN`: ProxyHeaven
- `PROXYJET`: ProxyJet
- `PROXYMA`: Proxyma
- `PROXYSIO`: Proxys.io
- `PROXYSIO_DATACENTER`: Proxys.io Datacenter
- `PROXYSCRAPE`: ProxyScrape
- `PROXYSCRAPE_DATACENTER`: ProxyScrape Datacenter
- `PROXYSELLER`: ProxySeller
- `PROXYSHARD`: ProxyShard
- `PROXYSTORE`: ProxyStore
- `PROXYVENTURE_MAIL`: Proxyventure Mail
- `PROXYVENTURE_MOBILE`: Proxyventure Mobile
- `PROXYVENTURE_PRIVATE`: Proxyventure Private
- `PROXYVENTURE_UDP`: Proxyventure UDP
- `PROXYVERSE`: ProxyVerse
- `PROXYWING_DATACENTER`: Proxywing Datacenter
- `PTUNNL`: pTunnl
- `PTUNNL_ISP`: pTunnl ISP
- `PUREPROXY`: Pureproxy
- `PYPROXY`: Pyproxy
- `PYPROXY_DC`: Pyproxy DC
- `PYPROXY_ISP`: Pyproxy ISP
- `PYPROXY_MOBILE`: Pyproxy Mobile
- `QG`: QG
- `QUANTUMPROXIES`: Quantumproxies
- `QUARKIP`: Quarkip
- `RA4W`: RA4W VPN
- `RAINPROXY_EXCLUSIVE`: Rainproxy Exclusive
- `RAMPAGE`: Rampage
- `RAMPAGE_CORE`: Rampage Core
- `RAPIDPROXY`: Rapidproxy
- `RAPIDSEEDBOX_DATACENTER`: Rapidseedbox Datacenter
- `RAYOBYTE`: Rayobyte
- `RAYOBYTE_DATACENTER`: Rayobyte Datacenter
- `RAYOBYTE_ISP`: Rayobyte ISP
- `REBIRTHPROXY`: Rebirthproxy
- `RESITO`: Resito
- `RICHPROXIES_ISP`: Richproxies ISP
- `RISEUPVPN`: RiseupVPN
- `ROUNDPROXIES_DATACENTER`: Roundproxies Datacenter
- `ROXLABS`: Roxlabs
- `S5PROXIES`: S5Proxies
- `SAFERVPN`: SaferVPN
- `SEAMLESSPROXIES_OMNI`: Seamlessproxies Omni
- `SEED4ME`: Seed4Me
- `SHELLFIRE`: Shellfire VPN
- `SHIFTER`: Shifter
- `SKYPROXIES`: Skyproxies
- `SLICKVPN`: SlickVPN
- `SMARTDNSPROXY`: SmartDNSProxy
- `SMARTPROXY`: Smartproxy
- `SMARTPROXY_DC`: Smartproxy DC
- `SNEAKERPROXIES_DATACENTER`: Sneakerproxies Datacenter
- `SOAX`: SOAX
- `SOAX_DATACENTER`: SOAX Datacenter
- `SOAX_MOBILE`: SOAX Mobile
- `SOCKSFIVE`: SocksFive
- `SPYDERPROXY`: Spyderproxy
- `SPYDERPROXY_BUDGET`: Spyderproxy Budget
- `STATPROXIES_ISP`: Statproxies ISP
- `STRIKEPROXY`: Strikeproxy
- `SURFSHARK`: Surfshark
- `SWIFTPROXY`: Swiftproxy
- `SX`: SX
- `SYPHOON`: Syphoon
- `THEIPKING`: Theipking
- `THORDATA`: Thordata
- `THUNDERPROXY`: Thunderproxy
- `TORCHLABS`: Torchlabs
- `TORCHLABS_PREMIUM`: Torchlabs Premium
- `TORCHLABS_X`: Torchlabs X
- `TORGUARD`: TorGuard
- `TRUSTPROXIES`: Trustproxies
- `TUNNELBEAR`: TunnelBear
- `TURBOVPN`: TurboVPN
- `UNKNOWNPROXIES`: Unknownproxies
- `UNKNOWNPROXIES_ISP`: Unknownproxies ISP
- `URBAN_VPN`: Urban VPN
- `USAIP`: USAIP VPN
- `VAULTPROXIES`: Vaultproxies
- `VITALPROXIES_PRIVATE`: Vitalproxies Private
- `VITALPROXIES_STANDARD`: Vitalproxies Standard
- `VN5SOCKS`: VN5Socks
- `VPN_FACILE`: VPN Facile
- `VPNAC`: VPN.ac
- `VPNGATE`: VPNGate
- `VPNHT`: VPNHT
- `VPNTUNNEL`: VPNTunnel
- `VPNUK`: VPNUK
- `VPNUNLIMITED`: VPNUnlimited
- `VYPRVPN`: VyprVPN
- `VYX`: Vyx
- `WARP`: WARP
- `WAVEPROXIES`: Waveproxies
- `WAVEPROXIES_PREMIUM`: Waveproxies Premium
- `WEBSHARE`: Webshare
- `WEBSHARE_DATACENTER`: Webshare Datacenter
- `WEPROXIES`: Weproxies
- `WINDSCRIBE`: Windscribe
- `WIRED_BRIGHT`: Wired Bright
- `WIRED_IPROYAL`: Wired Iproyal
- `WIRED_OXYLABS`: Wired Oxylabs
- `WIRED_PACKET`: Wired Packet
- `WIRED_SMART`: Wired Smart
- `WIREDPROXIES_ISP`: Wiredproxies ISP
- `XVPN`: X-VPN
- `ZENROWS`: Zenrows
- `ZETTAPROXIES`: Zettaproxies
- `ZINY`: Ziny
- `ZYTE`: Zyte