Free proxy lists: a row, 30 months of tests, and who runs them

What a row in a free proxy list says

ProxyScrape describes its list as public HTTP, HTTPS, SOCKS4 and SOCKS5 proxies from more than 180 countries, refreshed every minute, and says a proxy is removed from the list once it stops answering within a 15-second timeout. Its table has columns for protocol, IP address, port, country, anonymity, HTTPS, latency and last checked, and the list can be exported as text, JSON or CSV. The free-proxy-list.net table, run by a company called Didsoft, has the same idea, with a column headed Google that the page does not define in the text we read, while its FAQ says these free proxies do not support Google, Instagram or Craigslist. So a row is an address and port that the list says answered when it last checked, with a few labels attached.

Two of those labels need a reading. Anonymity comes in three levels on both pages. Didsoft defines them: with an elite proxy the websites cannot detect that you are using a proxy; with an anonymous one they know it but cannot see your real IP address; with a transparent one they know both. The HTTPS flag is less obvious. Didsoft says an HTTPS proxy is one that supports secure websites. The Proxifly repository adds a distinction: the flag on an HTTP proxy only says the proxy can fetch HTTPS targets, which it calls “a different thing” from a proxy you reach by opening an encrypted connection to the proxy itself.

The pages differ on how fresh a row is and how many rows there are. ProxyScrape says its list updates every minute and its GitHub mirror every 5 minutes. Proxifly says every 5 minutes, and at its latest update, at 16:15 UTC on 30 October 2026, it counted 10,871 working proxies from 143 countries. The Didsoft page says “updated every 10 minutes” in its heading and every 30 minutes in the text above it, and a statistics section further down the page gives a total of 1813 IPs in 1528 subnets in 94 countries, with a note “Updated every 20 mins”. ProxyScrape says its list typically holds more than 20,000 live proxies. Each figure comes from that list’s own checks, so we do not set them side by side.

The study we use below chose its first nine lists from the top Google results for “free proxies” and “open proxies” in April 2021, and added the others by the same method, and checked that each list was free, with no paywall or account. Its Table I includes lists named FreeProxyList, ProxyScrape and GeoNode. The pages we read do not measure who runs the proxies they list (ProxyScrape only says volunteers host them), how many of them keep working over time, or whether they change the pages that pass through them.

What the listed proxies did in 30 months

The study is Free Proxies Unmasked, by Naif Mehanna, Walter Rudametkin, Pierre Laperdrix and Antoine Vastel, from Univ. Lille, Inria, CNRS, Univ. Rennes and Datadome, presented at the MADWeb workshop in 2024 and posted on arXiv on 4 March 2024. The authors collected proxies every day from 11 public lists between April 2021 and the end of October 2023 and ended up with 640,693 unique ones. Each proxy was tested once a day against a test site the authors control, whose page is 2 bytes of plain text, so any change to the page could be seen. Across 949 runs, 29 were discarded after crashes or inconsistencies.

The first number is the one that sets the scale: 221,319 proxies passed the test at least once, which the study puts at 34.5%, and on an average run 3.36% of the proxies were verified as working. Table II sorts every proxy by how often it answered, and the largest group is the one that never did: 419,374 never answered, 183,589 were short-lived, 19,017 rarely answered, 6,444 answered on and off and 12,269 answered on more than 90% of the tests. The dataset holds 368,628 HTTP proxies and 272,065 SOCKS ones.

HTTP proxies did better than SOCKS ones in that table: of the 12,269 that answered on more than 90% of the tests, 12,199 were HTTP and 70 were SOCKS. The authors add that 42,515 proxies worked only once in their whole lifetime, and call the number of proxies that cycle between active and inactive states a sign of low stability.

Silence did not mean a proxy was gone. Of the proxies that ever answered, 46.4% were alive at their first test, while at least 22.3% of the collected proxies took more than 10 days to become active. The authors offer two possible reasons: lists are easy to reach, so proxies face heavy load and answer too slowly, or the proxy is installed on a device that is not always switched on. And 156,015 proxies came back after being inactive: more than 50.8% of those stayed silent for up to 10 days before resuming, 14,970 of them (9.5%) for more than 100 days. The authors conclude that a proxy that looks inactive cannot be assumed dead.

Lifetime and uptime tell different stories. Counting from the first to the last day a proxy was seen active, 30.8% lasted more than 100 days and 9.1% more than 500. Counting the days it was actually active, only 11% were active for more than 100 days. The study cites an earlier one, by Scott and others, that found a median life of 7 days for free proxies. The authors’ own summary is that stability cannot be expected from free proxies, though a few are stable.

On geography, the United States and China supply the most proxies that answered at least once, 31,906 and 19,882, followed by Indonesia and Brazil. The proxies sit in more than 15,000 autonomous systems, the networks that announce address blocks, and Chinanet is the largest, with more than 37,560. The study says plainly where it can be wrong: one test a day means a proxy under heavy load that day counts as inactive, and the Shodan data used in the next section was gathered once, at the end. The data ends in October 2023, so the figures describe those 30 months and not today’s lists.

Who runs them: the question the study leaves open

The authors write that when you connect to a free proxy it is unclear whether its behaviour is malicious by nature or whether it was compromised by a vulnerability without the administrator knowing. They tried to get closer through Shodan, a search engine that records what software answers on an internet address. Shodan, read once in October 2023, had data for 112,623 addresses of proxies that had answered, 60% of them. On those addresses it identified 4,452 distinct vulnerabilities (CVEs) in 1,158 different pieces of software, 578 of them with a severity score of 9 or more. The authors count 1,755 that allow unauthorised commands to be run and 2,036 that help gain privileges on the device. In all, 13,742 addresses, carrying 27,371 proxies that had answered, had at least one vulnerability.

The software on the addresses points at routers. MikroTik software appears on 42,206 addresses, covering 49,971 proxies that had answered, and on more than 66% of those addresses no third-party software was identified, which the authors say suggests that the proxies on those addresses are likely due to MikroTik-linked software. They link 602 CVEs to it and write that the ease of identifying a router’s software, together with the number of CVEs, makes routers “an easy target” for attackers. Cameras show up too: Hikvision cameras on 1,720 addresses, behind 1,790 proxies.

From this the authors conclude that the widespread vulnerabilities and software with proxy capabilities indicate many free proxies likely result from compromised devices rather than intentional deployments. In the same paragraph they write that the intentional use of Cloudflare and concealment of the real address by some proxies suggests efforts to mask the servers’ true locations, often indicating a willingness to pursue malicious intent. The counts behind that: 17,924 proxies concealed their true address, and the study writes that it is unclear whether it was hidden from the proxy’s user, from the website or from both. Of 16,957 addresses on a content delivery network, 10,131 hid the real address at least once. Elsewhere the authors suggest that some stable proxies may come from misconfigurations that expose them, and that, as with some residential proxy networks, users might be induced to install malicious browser extensions or desktop applications that covertly function as proxies. Neither idea is tested in the study.

The study also assumes that a share of the listed proxies exists because of the Log4j vulnerability (CVE-2021-44228), citing Sysdig’s Threat Research Team. Sysdig, a security company, calls its case proxyjacking: an attacker used Log4j in an Apache Solr application to install an agent that turned the compromised host into a proxy, and sold its address to proxyware services such as IPRoyal Pawns, Honeygain and Peer2Profit. Sysdig’s estimate is that a modest compromise of 100 addresses would net nearly $1,000 a month, and it quotes a rate of $9.60 a month for an address active around the clock on pawns.app. It also writes that the owner’s address could be used in malicious or illegal activity, and, citing a law firm, that an address is “often the starting point” of an investigation. The Sysdig post we read does not mention free proxy lists; we use it only for the way a compromised device can become a proxy.

Three descriptions of who is behind the proxies sit side by side. ProxyScrape says the proxies are public and “hosted by volunteers”. Oxylabs, a company that sells proxies, says many free proxies are “operated by unknown parties”. The study, which tested the proxies, says the question is unclear and leans towards compromised devices without proving it.

What they do to the page

The test page gives the study a way to see whether a proxy changed what passed through it. In all, 16,923 distinct proxies altered the content at least once. On an average run, 5.7% of the proxies that answered returned altered content: 6.6% of the HTTP ones and 6% of the SOCKS ones. The altered content averaged 36 kilobytes against the 2 bytes expected, because 88.9% of the altering proxies returned a full HTML page.

What that means is where the study speaks with two voices. Its abstract says the 16,923 proxies indicate “potential malicious intent” by their owners. The body says most altered content is due to misconfigured services rather than malicious intent: the authors extracted the web addresses from the saved pages, found that many of the most common relate to MikroTik, pointing to misconfigured routers, and found others tied to cloud providers such as Tencent and DigitalOcean. They add that Tsirantonakis and others reached the same conclusion, with only 5.15% of the proxies that alter content doing so with malicious intent.

The same earlier studies, as the paper summarises them, measured different things in different years. Perino and others, in the ProxyTorrent study, tested 180,000 proxies over 10 months and found fewer than 2% actually proxying traffic and about 10% showing malicious behaviour such as injecting advertisements or intercepting encrypted connections. Mani and others studied more than 107,000 open proxies over 50 days and found that in most cases the manipulated content is not malicious. Tsirantonakis and others looked at 65,000 proxies over two months and found that over 38% of the working ones changed something. Choi and others collected over 7,000,000 proxies, more than 1,000,000 of them open, and reported 28.23% used for spam and 6.97% for attacks. We do not merge these numbers: the methods and the years differ.

Encryption changes what a proxy can alter. For the last 477 runs the study tested each proxy on both the HTTP and the HTTPS endpoint of its test site. On average 371 proxies answered on the HTTPS endpoint, 2.5% of those that answered on HTTP. The authors give two reasons: a simple proxy is easier to set up without HTTPS, and a proxy with bad intentions might avoid secure requests because encrypted content resists tampering. They note that browsers now warn about sites with an invalid or missing certificate, which prevents many attacks that alter traffic, and that an owner may count on users running outdated software. The Shodan data also shows the PPTP protocol, which the authors call outdated, on 14,249 addresses. The conclusion says free proxies should “generally be avoided”, a risk the authors tie to privacy, content manipulation and the lack of HTTPS.

What the sellers say, and where the pages differ

The pages we read are not neutral. ProxyScrape and Didsoft run free lists and also sell proxies, and so does Oxylabs, whose article is about why not to use the free ones. Read each as a company describing its own product category.

Oxylabs says free proxies are generally unsafe and lists the risks: little or no encryption, malware and cookie theft, logging of activity, and poor performance with addresses that get flagged because many users share them. It writes that if you get something for free, “you are the product”. Its precautions are to stay away from email, banking and other sensitive accounts, to use free proxies only in an isolated environment such as a virtual machine or a disposable browser profile, and not to install software from a free proxy provider. It adds that the precautions only reduce risk and that free proxies can “never be made truly safe”. It does allow limited uses: learning and testing, reaching regional content for a short time, and very small scraping jobs. It also quotes market prices for paid proxies, not its own: about $1.50 to $4 per GB for residential proxies on many providers, and often around $0.20 to $2 per IP a month for datacenter ones on shared or basic dedicated plans. It also lists free plans and trials from sellers, including its own $5 credit, which are offers and not advice from us.

Didsoft frames the same product differently. Its proxies are public HTTP proxies collected from the internet, which it calls “unstable and usually slow” and cheap, suited to users who need many IP addresses and use each for a short while, especially SEO and traffic tools. It says they do not work on Google, Instagram or Craigslist, and, in an FAQ for people who buy its lists (“Are the proxies exclusive to me?”), that “They are not exclusive”: it provides the same proxies to other users. ProxyScrape answers the question whether a proxy protects you from hackers by saying it may add a layer of protection but you are not 100% safe, because the proxies are public and may be infected. It says they can be used for anything but some may be banned on the services you want, that it does not know how much bandwidth they have, and that they come online and go offline constantly. Proxifly asks that its proxies be used responsibly, without abusing them.

Put next to the study, these are different kinds of statement. The sellers describe risks and give advice, the list pages describe how they check, and the study measures how proxies behaved on a test page over 30 months and marks what it cannot tell. The three list pages we read do not say whether any listed proxy altered a page for the person using it; the study measured that only on its own test page, not for a real user. If you want the wider picture of what a proxy is and how it differs from a VPN, our page on what a proxy is covers the kinds of proxy; what a VPN is used for covers the tunnel option, and encrypted DNS covers a different step in the path.

What we did not use

We tested nothing and connected to no proxy from any list. We did not open the Geonode, spys.one and hide.mn lists, nor the ScraperAPI, Webshare and Olostep pages, so nothing on this page comes from them. In the copy of the study text that we read, Table I pairs some list names with the wrong web addresses, so we name the lists but give no addresses for them. Its data ends in October 2023, and the Shodan data was taken once, so the figures about vulnerabilities describe that moment.