Free Proxy Lists: What You Actually Pay For Them

Free proxy lists are one of the few places in infrastructure where the product is given away at genuine cost to whoever supplies it. Bandwidth costs money. Servers cost money. Somebody is covering both for thousands of strangers, and it is worth working out why before routing anything through them.

The answer is rarely charity, and rarely a conspiracy either. Most entries are simply broken, and a meaningful minority are working exactly as their operator intended.

Where the entries on a public list come from

Aggregator sites build their lists by mass-scanning the internet for open ports 3128, 8080, 8888 and 1080, then testing which of them will relay a request. Four categories of host end up in the results.

• Misconfigured forward proxies. A Squid or nginx instance meant for an internal network, exposed to the internet by a firewall rule nobody reviewed. The owner does not know it is on a list and will fix it the moment they notice the bandwidth bill.
• Compromised hosts. Routers with default credentials, unpatched IoT devices and hijacked VPS instances. Proxying is one of several services the intruder monetises, alongside spam relay and bot traffic.
• Deliberate collection points. One small VPS, an open proxy daemon, and a submission to a few aggregators. The setup cost is a few dollars a month and the return is a live feed of other people's requests.
• Expired or leaked commercial exits. Gateway credentials from a lapsed trial, or a residential exit whose session was captured and republished. These work briefly and then disappear.

The lists also copy each other, so the same dead addresses circulate for years and a "verified 5 minutes ago" badge usually means an automated TCP connect succeeded, nothing more.

Plaintext HTTP gives the operator an edit button

When you request an http:// URL through a proxy, the proxy handles the full exchange. It reads your headers, forwards the request, receives the response, and passes back whatever it likes. Modification is as easy as observation.

Typical edits are commercial rather than dramatic: a script tag appended before the closing body tag, an affiliate parameter added to outbound links, an ad frame injected into the markup, or every https:// link in the served HTML rewritten to http:// so your next hop is also readable. For a scraper, the damage is quieter than any of that suggests. Injected markup either breaks your parser or, worse, passes it and writes subtly wrong values into your database. Status codes stay at 200 throughout.

# Fetch a static page directly and through the candidate proxy, then compare
curl -s http://example.com/ > direct.html
curl -s --max-time 20 -x http://198.51.100.7:8080 http://example.com/ > proxied.html

diff direct.html proxied.html
# Any output on a page that does not change per request is the operator editing traffic

What HTTPS protects, and what it leaves exposed

Request an https:// URL and your client issues a CONNECT, the proxy opens a raw TCP tunnel, and TLS is negotiated end to end with the origin server. The operator cannot read or alter the body. That is a real protection and it removes the injection problem entirely.

What remains visible is still substantial: the destination hostname in the CONNECT line, the timing and size of every exchange, your source IP, and any Proxy-Authorization header you send. An operator running a collection point learns which sites you scrape, how often, and from where, which is enough to sell your target list to a competitor or to tip off the target itself.

How credentials leave through an open proxy

Credential loss through a hostile proxy is mundane in mechanism. Anything travelling over plaintext is readable, and quite a lot still travels over plaintext inside automated tooling.

HTTP Basic authentication is base64, which is encoding rather than encryption, so an Authorization header on a plaintext request is a plaintext password. Session cookies without the Secure attribute get sent over http:// too, and a captured session cookie is account access without anyone needing the password. API keys placed in query strings appear in the request line itself. Internal endpoints reached over plain HTTP because "it is only on the VPN" leak the moment the traffic is routed through a stranger.

There is a second-order version worth flagging. Some list entries include user:password pairs. Those credentials belong to whoever originally paid for the service, they are being republished without consent, and using them puts you on the wrong side of an access control decision rather than merely on the wrong side of good judgement.

The addresses arrive pre-blocked

Public lists are public. Every reputation vendor, anti-bot service and fraud platform can download the same file you did, and many of them do exactly that on a schedule. An address that appears on an aggregator this morning is in commercial blocklists by the afternoon, before you have sent a single request through it.

The underlying reputation is bad on its own merits as well. These addresses have been used by thousands of people for credential stuffing, spam and scraping, and most of them sit in hosting ASNs that any target can identify from a registry lookup, as described in what are residential proxies. Against a defended target the outcome is a challenge page or a 403 that never reaches the application layer. How that reputation is scored, and how much it varies between networks, is covered in proxy fraud score explained.

Uptime measured in minutes

Every category of free entry is unstable by construction. Misconfigurations get fixed, compromised boxes get rebuilt, honeypots rotate addresses, and any entry that does work is saturated within hours by everyone else who downloaded the same list.

The arithmetic gets unpleasant quickly. Take a 1,000-entry list and suppose 5 percent accept a TCP connection when you test them, and half of those return a response that passes a content check. You have 25 usable exits, shared with strangers, decaying by the hour. Validating that list at a 20-second timeout with 50 concurrent checks takes around 400 seconds of wall clock, and you get to repeat it every few hours. Meanwhile your crawler spends most of its time waiting on connect timeouts rather than downloading anything, which is the failure mode that makes free proxies feel slow even when a working one is fast. The distinction between transport failures and target failures is worth reading up on in proxy success rate explained.

Routing through a compromised host is your problem too

When the host is somebody's hijacked router, your traffic is transiting property whose owner never authorised it. Unauthorised-access statutes, the CFAA in the United States and equivalents across the EU and UK among them, attach liability to the access itself. Finding an address on a public list is not authorisation, and the fact that a third party opened the port does not transfer permission to you.

There is a practical dimension as well. Your requests carry the victim's IP address, so abuse complaints from your target land on their operator. If anyone investigates, the trail runs from the target, to the compromised host, to whatever the proxy logged about you, and the operator of a collection point keeps very good logs. General legal footing for proxy use is in are residential proxies legal, and none of this is legal advice.

The engineering time nobody budgets for

Working with a free list means building the things a provider would otherwise supply: a validator that re-tests every entry, a scoring layer that ranks survivors, health checks that eject them mid-run, failover logic, and something to detect responses that were modified in transit. Assembled, that is a proxy service. Badly built, permanently degrading, maintained by you at no charge.

Corrupted data is the cost that hurts longest, because it arrives without an error and propagates into whatever you built on top of it. A week-old pricing dataset with injected values in it is worse than no dataset, and finding out costs more than any proxy plan. One engineer-day a month spent tending a list already exceeds the price of an entry-tier residential plan.

When a free proxy is genuinely fine

There is a real, narrow band of legitimate use, and pretending otherwise is dishonest. Interception stops mattering when the traffic contains nothing worth intercepting and the answer is disposable.

• Checking how a public page looks from another network. Does your marketing site geo-redirect correctly, does a competitor serve different prices to a different country, is a public endpoint reachable from outside your own ASN.
• Confirming your own blocklist behaviour. Verifying that your WAF rejects an address you expect it to reject is a fine use of an address you do not trust.
• Learning the protocols. Watching a CONNECT handshake or a SOCKS5 negotiation on the wire is easier with a throwaway endpoint. The differences are laid out in HTTP vs SOCKS5 proxies.

The rule that keeps those uses safe is short. Nothing authenticated. Nothing whose result reaches a database. Nothing you would mind a stranger reading, logging or altering. And no dependency on it working, since it will not work tomorrow.

For anything else, the floor price of a paid pool is low enough that the comparison is not close. Entry-level plans are priced in single-digit dollars per gigabyte, and the current normalised ranking is in the cheapest residential proxies comparison. Every network we track is tested continuously from US and EU hosts, with the results published on the live benchmark table and the procedure in our methodology, so you can inspect failure modes before paying anything. Individual networks such as Decodo have their own page. If you are choosing for the first time, how to choose a proxy provider walks through the decision, and the web scraping proxy guide covers how to wire one into a crawler.