Originally published on proxymint.
What studies of free proxy lists found: dead proxies, leaked IPs, injected scripts and swapped certificates, what HTTPS hides, and when free is fine.
TL;DR
- Free proxies are unknown machines run for unknown reasons. Some are misconfigured servers, some are compromised routers, and some exist to watch or rewrite traffic. A public list does not say which is which.
- Most listed free proxies do not work. A 2018 study of more than 107,000 listed open proxies found over 92% unresponsive, and a 2024 study of 640,693 free proxies found an average of 3.36% working on any given run.
- Measured misbehaviour is real but not universal. Researchers caught proxies injecting cryptomining scripts, modifying Windows executables, swapping TLS certificates and forwarding the client IP in an X-Forwarded-For header.
- HTTPS through CONNECT hides content, not metadata. With certificate checks on, the proxy cannot read pages or cookies, but it still sees the client IP, target hostnames, timing and volume.
- Some free apps make the user the proxy. Google and the FBI both documented free VPN and bandwidth-sharing apps in 2026 that enrolled phones and PCs as exit nodes for other people's traffic.
Key takeaways
- Send nothing of value through a free proxy. No passwords, session cookies, API keys, payment data or files that will be run.
- Keep certificate verification on. verify=False, curl -k or ignoreHTTPSErrors turn a TLS man-in-the-middle from a failed attempt into a successful one.
- Validate every response when scraping through a proxy you do not control. An injected page still returns HTTP 200 and lands in the dataset unless something checks it.
- Remove free VPN apps with no subscription model, and any app that shares the connection without asking. They are the documented route by which home devices become someone else's exit node without consent.
- Pick the paid tier by target, not by price. Datacenter ports suit lenient targets and monitoring; residential or ISP proxies suit targets that block hosting ranges or tie accounts to an address.
Read the full guide on proxymint, with the commands, tables and sources.
Top comments (0)