Is This IP a Proxy? Reading the proxy Signal Without Blanket Blocks

Blanket-blocking every address tagged proxy treats an exit observation as a person-level verdict. On IP99 by ThreatHunter, proxy means something narrower: this address is currently being used as a proxy exit — often because it appeared in proxy supply being sold. That is not a static commercial VPN exit, a dial-up rotation pool, or a malware-hijacked household, and not a reason to hard-ban a whole building that shares the egress.

This walkthrough stays on free, no-key GET /v1/ip/{ip}. JSON samples were verified on 11 November 2026 UTC; run the curls yourself for a live snapshot. Notes: IP99, API, detect proxy / VPN, IP risk score.

What proxy is (and what it is not)

IP99's free lookup returns a 0–100 risk.score for freshness and strength of verifiable risk evidence, not attacker probability. risk.level follows the score (0 → none, 1–29 → low, 30–69 → medium, 70–100 → high). Signals appear only when they hit. Always branch on evidence_state (active / stale / none) before the score: score 0 + none is a coverage gap, not a clean bill of health. Official API wording: proxy = this address is currently being used as a proxy exit (often from observed proxy supply).

False equivalents:

1. proxy ≠ "this user is an attacker." The score is evidence freshness and strength, not person-level attribution. Shared egress means one ban can be one building.
2. proxy ≠ vpn. vpn is a static commercial VPN exit, often in IDC / hosting space and stable for weeks. proxy is observed exit use, including rotating residential supply.
3. proxy ≠ dialup_pool. A dial-up pool is the same address being redialed for new IPs — its own slug, often on DYN or MOB.
4. proxy ≠ hijacked_proxy. That slug means compromise; the account holder is typically the victim, so challenge rather than auto-ban.
5. hosting on IDC ≠ proxy. Public DNS and ordinary cloud servers sit in hosting space every day with score 0 and no proxy-class evidence.

Free /v1/ip does not return share_tier, evidence[], historical ?at=, honeypot_scan, honeypot_credential, or ipv6_range (Pulse / professional only). On the free tier, lean on evidence_state, score/level, signal type, usage_type, and your own velocity / device checks.

Hosting without a proxy vs a datacenter proxy exit

curl https://ip99.com/v1/ip/8.8.8.8

Verified 11 November 2026 UTC:

{
  "ip": "8.8.8.8",
  "computed_at": "2026-11-11T09:58:38Z",
  "evidence_state": "none",
  "geo": {
    "continent": "NA",
    "country": "US",
    "region": "California",
    "city": "Mountain View",
    "tz": "America/Los_Angeles"
  },
  "network": { "asn": 15169, "usage_type": "IDC" },
  "risk": {
    "score": 0,
    "level": "none",
    "signals": ["hosting"]
  }
}

hosting here is a network attribute on public DNS. evidence_state: none with score 0 means no verifiable proxy-class evidence on file — not "safe," and not proxy. "Block all IDC" would refuse this address for the wrong reason.

Now a Paris datacenter address whose live lookup carries proxy (alongside hosting and osint):

curl https://ip99.com/v1/ip/178.20.30.146

Verified 11 November 2026 UTC:

{
  "ip": "178.20.30.146",
  "computed_at": "2026-11-11T09:58:39Z",
  "evidence_state": "active",
  "geo": {
    "continent": "EU",
    "country": "FR",
    "region": "Île-de-France",
    "city": "Paris",
    "tz": "Europe/Paris"
  },
  "network": { "asn": 46475, "usage_type": "IDC" },
  "risk": {
    "score": 84,
    "level": "high",
    "signals": ["hosting", "osint", "proxy"]
  }
}

Same IDC + hosting space as many VPN exits, but the slugs here are proxy and osint, not vpn. Branch on each matched signal. Scores decay — a documented October capture of this address scored 99 — so re-curl for a live snapshot.

Most new proxy supply is not in that IDC slice. The official API docs include a residential (DYN) demo whose documented capture carried proxy alone (last octet masked: 86.111.136.x, ASN 15547, CH / Valais / Sitten; score 86 / high in the 17 September 2026 sample). A hosting-only blocklist under-covers that majority.

What the weekly capture mix says

Between 4–10 November 2026 (UTC), IP99 captured 10,561,845 new proxy-class exit addresses (+2% vs the previous 7 days). By usage type: 80.0% residential (8,445,664), 12.1% mobile (1,280,337), 3.9% gateway/NAT (412,561), 3.2% datacenter (338,371). 59 upstream sources. Figures generated 11 November 2026, 09:36 UTC. Source: proxy-exits. Aggregates only; no address lists.

That count is first-party proxy-class observation (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) — newly seen in the window, not a global census, same IP counted once. More than 92% of newly seen exits sit in residential or mobile space, so a datacenter blocklist or a blanket proxy ban over-punishes shared egress and still under-covers most new supply.

A practical branch (evidence_state first)

Official triage order: evidence_state → score/level → signal type → usage_type. Generic guidance (not a contract): score 0 → do not stamp "clean"; 1–29 → observe; 30–69 → captcha / throttle / second factor; 70–100 → block only when business cost allows, and not at building scale on shared egress. Score meaning: IP risk score.

1. Read evidence_state, then risk.signals and network.usage_type.
2. If proxy is active: treat it as a current exit, not attacker probability. Prefer step-up plus velocity / device checks over hard-banning shared building egress. Branch separately if vpn, dialup_pool, or hijacked_proxy also hit.
3. If proxy is stale: weak, expired feature only (score 0). The address may already be back with an ordinary subscriber — do not apply an old exit as a fresh ban.
4. hosting on IDC without proxy / vpn / dialup_pool is a network attribute, not a proxy verdict. vpn without proxy is a static commercial VPN exit, a different playbook than rotating residential supply.
5. If hijacked_proxy is also present: challenge; do not ban the account (the owner is the victim).
6. Never mark score 0 + evidence_state: none as "trusted clean." Re-query at decision time and store computed_at rather than caching a verdict for days.

Anonymous quota is 500 lookups/day per client IP (60/min); a free logged-in key raises the daily cap to 5,000/day. Check remaining with GET https://ip99.com/v1/me or the X-Daily-* headers. OpenAPI: https://ip99.com/openapi.json. Pricing: https://ip99.com/en/pricing.

Do not treat IP99 scores as identical to other ThreatHunter datasets — this article only claims what free /v1/ip and the cited product pages document.

Try it

curl https://ip99.com/v1/ip
curl https://ip99.com/v1/ip/8.8.8.8
curl https://ip99.com/v1/ip/178.20.30.146
curl https://ip99.com/v1/me

IP99 is a ThreatHunter product. Use the free lookup to separate a current proxy exit (proxy) from commercial VPN static exits, dial-up rotation pools, hijacked-victim egress, ordinary hosting, and leftover labels after an address changed hands — before a blanket block bans a customer who shares the building's egress. Start at https://ip99.com; read detect proxy / VPN, proxy-exits, and https://ip99.com/api.