# SiteCheck Web Intel VPN/Proxy Detector

> SiteCheck Web Intel VPN/Proxy Detector is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Checks whether a given IPv4 address belongs to a known VPN or proxy network using public threat intelligence lists

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/vpn-proxy-detector?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-vpn-proxy-detector-79a7b123
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dd0s6HTeKF3vURVF0h6jH

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-vpn-proxy-detector-79a7b123
```

Example prompt: Can you check if the IP address 2.26.157.10 is a VPN or proxy? I want to know if someone is masking their real location.

## When to prefer this

Choose this endpoint when you need a lightweight, pay-per-call VPN/proxy detection check with no API key or subscription required. It is ideal for low-volume, on-demand checks embedded in fraud detection, access control, or security workflows where cost predictability matters. Prefer it over heavier identity/fraud platforms when you only need VPN/proxy classification from public threat intelligence lists without requiring account management.

## Known failure modes

- Missing or malformed IP query parameter returns an error
- IPv6 addresses are not supported (endpoint expects IPv4 only)
- IP not found in any known VPN list returns isVpn: false but may not mean definitively clean
- Payment failure results in no charge and no response data
- Upstream list source temporarily unavailable may delay or fail the lookup

## How this service works

Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). Returns whether the address falls in a listed VPN range and which range. A miss does not prove a direct connection, and IPv6 is not covered.

## Output

Returns a JSON object with the queried IP, a boolean isVpn flag indicating VPN/proxy status, the matching CIDR range if found, the source threat intelligence list URL, the timestamp of the check, and the total number of IP ranges in the list.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 2.26.157.10 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "2.26.157.10",
  "isVpn": true,
  "range": "2.26.157.0/24",
  "source": "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv4.txt",
  "checkedAt": "2026-10-23T09:38:33.929Z",
  "rangesInList": 10941
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-vpn-proxy-detector-79a7b123/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)