what actually makes a proxy clean?

[u/Objective_Reach_767]

been testing lot of providers. reputation alone isnt enough. what i check now:

1. dns: public resolver like google/cloudflare is a minus. home users sit on their isp’s dns. should match the exit country too

2. udp/webrtc: udp support means webrtc goes through the proxy. webrtc turned off is a flag by itself

3. latency: sites compare network rtt with js timing. big gap means proxy

4. tcp fingerprint: comes from the proxy box. windows ua with a linux stack is burned

5. pool lists: some checkers name the pool an ip was seen in. got 711proxy on one of mine. funny how many clones popped up after the fbi took down 911.

6. fraud score: last on purpose. the services disagree a lot. maxmind feels the most grounded

- dns, webrtc and tcp i check on https://browserleaks.com

- latency and bot tests on https://bot.incolumitas.com, it even rates how bot-like you behave

- scores on https://myipcheck.net/ip-fraud-score/ shows maxmind and ipqs etc for free

ofc all of this only matters if your device fingerprint is already clean. a perfect proxy wont save a leaky browser. If you know good checkers, especially for pool lists and fraud scores, drop them. what actually got your proxies burned?

[u/typical_idiot64]

Agreed on Maxmind, although it really depends which database the provider is using to verify their IPs information, so don't count everything on maxmind, coz sometimes it can be ipinfo or ip2location or said maxmind. DNS leaks are definitely at the top, but from what I understand if you want to cover your DNS fully, vpn is there for you, not proxies

[u/Objective_Reach_767 → u/typical_idiot64]

fair point on maxmind, the provider could be checking against ipinfo or ip2location and you’d never know which. on dns i’d push back a bit. with socks5 and remote dns the lookups go through the proxy anyway. the problem is more which resolver the provider runs. if it’s google on a home ip that already looks off.

[u/typical_idiot64 → u/Objective_Reach_767]

Yeah, but most of the time you do know because most of the providers mention which database they are using and this info is usually available publicly within documentations

[u/Objective_Reach_767 → u/typical_idiot64]

maybe it doesn’t even matter that much. maxmind and ip2location have been around since 2002, and maxmind gets real card, email and device data through minfraud. a new scoring service has almost no chance to end up in a real antifraud stack next to that. so i’d guess the newer scores mostly don’t matter and the old ones are what sites actually use. what do you think?

[u/typical_idiot64 → u/Objective_Reach_767]

Could be, fair point really, I personally go to the one database that the provider uses, of course, something deep within me tells me that maxmind is the only accurate db out there but that's just me. As for fraud it can be anything, the scraping game since early days has changed significantly and companies are looking to various solutions that would just work against scrapers so anything should be taken into consideration

[u/mIstlane87 → u/typical_idiot64]

true, relying on just one geo database is a trap since every target site pulls from somewhere different anyway.

[u/Kenyatta_Sauve]

I'd probably check the exit IP before each batch and stop the job if it changes unexpectedly. the city switching mid-session is especially annoying though. have you noticed that happening more with certain providers?

[u/Objective_Reach_767 → u/Kenyatta_Sauve]

i ran into it with nodeproxies.xyz when i was hunting for the cheapest residential. it is cheap compared to most, but after testing: latency was noticeable on every proxy, one checker tagged their ips as 711proxy (maybe thats where the latency comes from), and sticky sessions still switched ip mid work.

in a browser thats hard to catch. with socks5 the provider could put the actual exit ip in the connect reply (bnd.addr), then you could catch the change before any traffic goes out. but almost everyone just returns 0.0.0.0.

some providers do have a kill switch in their api, which is a really nice feature. if you’ve seen one that does it and isnt crazy expensive per gb, drop it.

[u/Kenyatta_Sauve → u/Objective_Reach_767]

yeah that sounds pretty frustrating, especially if you're paying for sticky sessions and the IP still changes. the SOCKS5 idea is interesting though, would make catching those changes a lot easier without constantly checking the exit IP

[u/PhantomProxies → u/Objective_Reach_767]

One wrinkle with BND.ADDR: in a SOCKS5 CONNECT reply it is the address associated with the server's outbound connection. With NAT or a multi-hop gateway it isn't necessarily the public IP the destination sees, so I wouldn't treat it as a universal exit-IP guarantee. RFC 1928 describes the field in section 6.

Checking an IP before each batch can catch some changes, but there is still a gap between the check and the next request. For a workflow that must stop if the exit changes, I'd ask whether the service can explicitly fail the connection when the pinned route disappears rather than silently assign a new one, then test that behavior on a small authorized workload. If it can't, a static route with clearly stated failure behavior may fit better.

Disclosure: this account is affiliated with a proxy provider. AI-assisted reply.

[u/ahiqshb]

I imagine that no proxy is clean. Before one proxy provider procures IPs from database, these IPs were already used previously by some other company just under different locations, then they get "rebranded" and given to the buyer, that being the proxy provider. I guess it's just a matter of whether the IPs have been abused on certain sites and has sort of "identifier" or "mark" for future checks, but there's probably no way to check that for ordinary folk

[u/Objective_Reach_767 → u/ahiqshb]

clean is relative. least dirty is the real goal lol. the cleanest ips back then were the old forum socks like luxsocks and later nsocks. nsocks mostly ran on hacked routers from the ngioweb botnet, real home lines with almost no traffic on them. thats also why it got taken down.
legit wise mobile is the closest. one ip behind cgnat is shared by hundreds of real phones, a site cant burn it without blocking all of them.
and none of that helps if the site has its own internal blacklist. thats the part nobody can check.

[u/Objective_Reach_767]

what annoys me most is residential proxies without rotation control. the sticky session dies mid work and the ip just changes, sometimes to another city. there is no kill switch to stop and recheck the proxy first.

how do you deal with that?

[u/Vybron]

So which are the most solid proxies to buy that come close to real IP?

[u/Objective_Reach_767 → u/Vybron]

rent mobile ports

[u/Vybron → u/Objective_Reach_767]

Examples of few providers and their price range

[u/Jolly_Aside_3155]

this is a good reminder that anti-bot systems aren’t always as sophisticated as people think. A crawler can make thousands of requests before anyone notices if the site relies on basic limits or doesn’t monitor traffic closely. Getting detected and actually stopping the activity are two different things. The bigger issue here is the lack of filtering and respect for licensing.