Features

Inside the Solarflare API.

Six capabilities that turn continuous proxy network observation into a usable signal for fraud, security, and data teams. No static blocklists. No opaque scoring. Just a fresh observed signal you can plug into existing risk decisions.

01 · Feature

Fresh observed proxy signals

Static IP databases lag behind real-world proxy infrastructure by weeks. Solarflare's signal is observational and current: if an IP has recently appeared in proxy network behaviour, the API knows. Use it to catch the long tail of residential and mobile proxy traffic that traditional vendors miss.

  • Continuous network testing, daily refresh
  • Captures residential and mobile proxy IPs
  • Designed for recency, not historical coverage
  • Complements MaxMind, IPinfo, and internal feeds
stream · live
12:04:21203.0.113.10residential
12:04:19198.51.100.42mobile
12:04:18192.0.2.77datacenter
12:04:17203.0.113.55residential
12:04:16198.51.100.9vpn
12:04:15203.0.113.21residential
12:04:14192.0.2.144datacenter
12:04:13198.51.100.88mobile
12:04:12203.0.113.193residential
12:04:11198.51.100.71vpn
12:04:10192.0.2.205datacenter
12:04:09203.0.113.42residential
12:04:08198.51.100.6mobile
12:04:07192.0.2.18datacenter
12:04:21203.0.113.10residential
12:04:19198.51.100.42mobile
12:04:18192.0.2.77datacenter
12:04:17203.0.113.55residential
12:04:16198.51.100.9vpn
12:04:15203.0.113.21residential
12:04:14192.0.2.144datacenter
12:04:13198.51.100.88mobile
12:04:12203.0.113.193residential
12:04:11198.51.100.71vpn
12:04:10192.0.2.205datacenter
12:04:09203.0.113.42residential
12:04:08198.51.100.6mobile
12:04:07192.0.2.18datacenter
02 · Feature

Simple API lookup

One endpoint, one IP, one JSON response. Authenticated with a bearer token, sub-200ms typical latency, no SDK required. Drop it inline at signup, login, payment, and high-value events.

  • Single GET /v1/ip/:ip endpoint
  • Bearer-token auth, no SDK lock-in
  • Sub-200ms typical response
  • Clean JSON: boolean, confidence, last seen, network type
terminal
$curl https://api.solarflare
/v1/ip/203.0.113.10
-H "Authorization: Bearer sf_live_•••••"
{
"ip": "203.0.113.10",
"observed_proxy": true,
"confidence": "high",
"last_seen": "2026-05-10",
"network_type": "residential_proxy"
}
$200 OK · 142 ms
03 · Feature

Bulk IP analysis

Send up to millions of IPs per batch through the bulk endpoint or by uploading a file. Get back a structured report with per-IP signals, network classifications, and aggregate stats. Built for retro-analysis of click streams, payment logs, and account cohorts.

  • Millions of IPs per batch
  • API or file upload (CSV, JSONL)
  • Aggregate breakdowns + per-IP detail
  • Async job model with webhook callback
job pipeline · live
queued38.4M
processing3.7M
done285M
04 · Feature

Last-seen timestamps

Recency matters in risk decisions. An IP observed yesterday is a different signal than an IP last seen six months ago. Solarflare exposes last_seen on every record so your risk model can weigh fresh observations more heavily — and decay older ones automatically.

  • ISO-8601 last_seen on every record
  • Configurable freshness windows
  • Decay-friendly for risk models
  • Distinguishes hot, warm, cold observations
05 · Feature

Confidence scoring

Confidence reflects how many independent observations support the signal, how recent they are, and how cleanly the IP's behaviour matches proxy infrastructure. Low-confidence signals are great for step-up verification; high-confidence signals are ready for hard blocks.

  • low / medium / high confidence levels
  • Network-type classification included
  • Threshold-friendly for fraud rules
  • Tuned for false-positive sensitivity
confidence stream · live
high88%medium11%low3%
60 s agonow · % of lookups
06 · Feature

Cross-network connections

Solarflare isn't a replacement for your existing stack — it's a single API that adds a fresh observed proxy dimension to MaxMind, IPinfo, internal fraud models, bot-detection vendors, SIEMs, threat intel platforms, and dozens of other downstream systems via webhook and REST integrations. No rip-and-replace, no architecture changes.

  • Plugs into MaxMind, IPinfo, and others
  • Connects fraud, SIEM, bot-detection, and threat intel
  • Webhook + REST integration patterns
  • Stable schema with semantic versioning
cross-network · tree (mirrored)
INMMSFFRIPIQTISIBDOK
Sample analysis

Want to test your IP data against Solarflare?

Send us a sample list of IPs and we'll return a proxy intelligence match report — confidence-scored, with last-seen timestamps and network-type classification. No commitment.