Blanket-blocking every address tagged proxy treats an exit observation as a person-level verdict. On IP99 by ThreatHunter, proxy means something narrower: this address is currently being used as a proxy exit — often because it appeared in proxy supply being sold. That is not a static commercial VPN exit, a dial-up rotation pool, or a malware-hijacked household, and not a reason to hard-ban a whole building that shares the egress.

This walkthrough stays on free, no-key GET /v1/ip/{ip} . JSON samples were verified on 11 November 2026 UTC; run the curls yourself for a live snapshot. Notes: IP99 , API , detect proxy / VPN , IP risk score .

What proxy is (and what it is not)

IP99's free lookup returns a 0–100 risk.score for freshness and strength of verifiable risk evidence , not attacker probability. risk.level follows the score ( 0 → none , 1–29 → low , 30–69 → medium , 70–100 → high ). Signals appear only when they hit.…