How to check a proxy is a question that comes up in two situations: you have just bought an address and want to make sure it is fit for the job, or your accounts have started getting verification prompts and you need to know whether the IP is to blame. In both cases the set of checks is the same: availability, anonymity, geography, blacklists, OS fingerprint and speed.
All six checks take about five minutes and need no paid services. Below is exactly what to look at, which tools to use and what result counts as normal.
Checking that the proxy works: does the port respond
The first question is whether the proxy is alive at all. This is checked in two stages: is the port open, and does an authenticated request go through it.
- Port. In PowerShell: Test-NetConnection 185.12.34.56 -Port 8000. On Linux and macOS: nc -zv 185.12.34.56 8000. “True” or “succeeded” means the port is open. A timeout means the port is closed, the address is wrong or your firewall is blocking the connection.
- Request through an HTTP(S) proxy. curl -x http://login:pass@185.12.34.56:8000 https://api.ipify.org. It should return the proxy's IP.
- Checking a SOCKS5 proxy. curl -x socks5h://login:pass@185.12.34.56:8000 https://api.ipify.org. The h suffix matters: DNS queries will also go through the proxy rather than from your computer. If HTTP works but SOCKS5 does not, the port serves only one protocol; at ProxyFarm both run on the same port.
- Response time. Add the -w "%{time_total}" flag to curl. Up to 1 second for datacenter and 2–3 seconds for mobile proxies is normal.
If you need to test a list of hundreds of addresses at once, use ProxyChecker, Proxifier in test mode or a Python script with the requests library and a thread pool. For a single address the online proxy checker is enough: it shows the status, protocol and response time.
Anonymity: what a site learns about you through a proxy
Proxies come in three anonymity levels, and the difference is critical when working with accounts.
| Level | What it passes to the site | How to detect | Suitable for |
|---|---|---|---|
| Transparent | Your real IP in the X-Forwarded-For or Via header | The My IP page shows your home address next to the proxy's | Nothing serious: the site knows who you are |
| Anonymous | The fact that a proxy is used, via the Via or Proxy-Connection header, but not your IP | Headers reveal the presence of a proxy | Scraping public data where it does not matter if the proxy is visible |
| Elite | Nothing: the site sees only the proxy's IP, headers are clean | My IP shows only the proxy address, no proxy headers | Accounts, advertising, platforms with anti-fraud |
To check: open the My IP page through the proxy and look at two blocks, the detected IP and the HTTP headers. If the headers include X-Forwarded-For, Via, X-Real-IP or Forwarded, the proxy is not elite. Separately check for a DNS leak: a service like dnsleaktest should show DNS servers in the proxy's country, not your home ISP's. A WebRTC leak in the browser is the third channel: with WebRTC enabled, a site can learn your local and external IP directly, bypassing the proxy. Anti-detect browsers spoof WebRTC; in regular Chrome it is disabled with an extension.
Geography and IP type: what platforms see
A proxy's country and city are determined not by the seller's claim but by GeoIP databases: MaxMind GeoIP2, IP2Location, ipinfo. Different databases may show different cities for the same address, and platforms use their own. So check in at least two.
What to look at:
- Country and city match what was advertised. A different city within the same region is acceptable; a different country is a defect.
- ASN and organisation. For a mobile proxy it must be a carrier: MTS PJSC, VimpelCom, MegaFon, T2 Mobile. For a residential proxy, a home ISP. If the organisation field shows a hosting company (Hetzner, OVH, Selectel), it is a datacenter address whatever the seller calls it.
- Connection type. ipinfo and similar services have a “type” field: hosting, isp, business, mobile. This is exactly what anti-fraud systems read.
- The IP's time zone must match the browser profile's time zone, otherwise anti-fraud will spot the discrepancy.
If you bought a “mobile” proxy and the ASN shows a datacenter, that is grounds for a refund. ProxyFarm refunds within the first 24 hours, no questions asked.
Checking IP reputation: is the IP blacklisted
Reputation is the address's history. If the IP was previously used to send spam or scan networks, it has landed in public blocklists, and platforms consult them on every login. Five databases worth checking:
- Spamhaus (SBL, XBL, PBL): the main email spam database. A listing in SBL or XBL is a serious minus. PBL is a special case: it covers whole ranges of dynamic and mobile addresses, so for mobile proxies it is normal, not a problem.
- Firehol (level1–level4): an aggregator of dozens of lists covering attacking IPs, bots and anonymisers. Level1 is the strictest, and a listing there almost guarantees captchas.
- Barracuda, SORBS, UCEPROTECT: email blocklists, important for services with email registration.
- AbuseIPDB: a crowdsourced complaint database with a confidence score in percent. Above 25 % is a warning sign.
- IPQualityScore, Scamalytics: an aggregated fraud score from 0 to 100. Up to 25 is clean, 25–75 is suspicious, above 75 is unfit for accounts.
Where to check: mxtoolbox.com/blacklists for email databases, ipqualityscore.com and scamalytics.com for fraud scores, abuseipdb.com for complaints. ProxyFarm's checker combines the Spamhaus and Firehol status in one report. Keep in mind that a mobile IP is shared by thousands of subscribers, so isolated AbuseIPDB complaints are natural for it: look at the overall picture, not a single flag.
p0f fingerprint: does the proxy's OS match your browser
A less well-known but important check. p0f is a tool for passive operating system detection based on TCP packet parameters: window size, TTL, option order. An anti-fraud site compares the OS reported by the TCP stack (that is, the proxy server) with the OS claimed by the browser's User-Agent.
If the browser says “Windows 11, Chrome” while the TCP fingerprint shows Linux (which most proxy servers run on), that is a discrepancy. For scraping it is irrelevant; for accounts on platforms with advanced anti-fraud it is a signal.
How to check: browserleaks.com/ip and whoer.net show the OS detected from TCP in the “OS by p0f” or “TCP/IP fingerprint” block. A normal result for account work is a match with the User-Agent or a neutral “unknown”. Mobile proxies, where traffic passes through an Android modem or a router, usually look natural. Datacenter proxies depend on the provider's setup: some spoof TCP parameters to look like Windows.
Speed and stability: how to measure honestly
A one-off speedtest says little: the proxy channel is loaded unevenly, and a mobile network changes throughout the day. Measure three parameters at different times of day.
- Latency (ping): time to first byte. Use curl with the -w "%{time_starttransfer}" flag. Datacenter: 5–50 ms plus the distance to the datacenter. Mobile: 40–120 ms. Residential: 50–300 ms.
- Throughput: download a 10–50 MB file through the proxy and divide the size by the time. A ProxyFarm dedicated mobile device delivers up to 40 Mbit/s; datacenter IPv4 is limited by the datacenter's uplink.
- Stability: 50–100 consecutive requests to the same URL and the share of errors. More than 2–3 % failures on a datacenter proxy is a reason to contact support. On a mobile proxy short drops during an IP change are normal.
Take measurements in the morning, afternoon and evening: mobile networks are noticeably slower between 7 and 10 pm. If the proxy is for night-time scraping, daytime measurements are not representative.
Related questions
How do I check a SOCKS5 proxy without any software, straight from the command line?
Run curl -x socks5h://login:pass@ip:port https://api.ipify.org. If it returns the proxy's IP, SOCKS5 works, with DNS going through the proxy too. If it errors while the HTTP variant with -x http:// works, the port supports HTTP only.
Is a blacklisted IP always bad?
No. Spamhaus PBL covers whole ranges of mobile and dynamic addresses, which is normal for a mobile proxy. What matters is Spamhaus SBL and XBL, Firehol level1 and a fraud score above 75. Isolated AbuseIPDB complaints against a mobile IP are also natural: the address is shared by thousands of subscribers.
What should I check first if my accounts start getting captchas?
The IP type by ASN and the fraud score. If the address suddenly shows as hosting or its score has climbed above 50, the platform has reassessed its reputation. Second, whether the IP's time zone and geolocation match the browser profile. Third, WebRTC and DNS leaks.
How often should I re-check proxies I have bought?
The full set at purchase and whenever the platform's behaviour changes. Availability and speed automatically, every few minutes, if the proxy is in production. Blacklists once a week: an IP's reputation shifts if other users worked from it or a neighbour behind the mobile NAT sent spam.