Proxy tier benchmark › Protection systems
Which state registries put a captcha in front of their search?
A captcha signature in this dataset means one of two very different
things, and the harness cannot tell them apart: an interstitial served instead
of the page, or a reCAPTCHA widget embedded in the page as part of a normal
search form. The pattern that fires is g-recaptcha or recaptcha/api.js,
which any page embedding the widget will contain.
Both matter for the same practical reason — no proxy tier solves either — but only one of them is a block, and this page separates them by response size.
Portals behind reCAPTCHA and generic captchas in this census
Sixty-one candidate URLs were probed once each from a clean US datacenter IP on 2026-08-18; 6 of the portals below were then measured through all six proxy arms, ten rounds each.
| Portal | Measured in | Behaviour |
|---|---|---|
us_la_corasearch |
six-arm run | 200 with a 24.6-26.2 KB body on 58 of 60 requests, matching the probe's fetch of the working search form; the widget is probably part of the page |
us_ne_corpsearch |
six-arm run | 200 with a byte-identical 26,240-byte body on 23 of 60 requests, reached only through a proxy; the same host tarpits direct traffic |
us_nc_realestate |
six-arm run | 404 with a 34,196-byte reCAPTCHA page, on the residential arm only; every other arm got HTTP 202 with an empty body |
us_ut_bes |
six-arm run | 200 with a byte-identical 52,406-byte body on the anti-detect and residential arms, matched by the generic captcha rule |
us_ar_sos_search |
six-arm run | 405 Method Not Allowed with a 2.5 KB captcha body on 6 of 60 requests, all on plain datacenter arms |
aliexpress_item |
six-arm run | 200 with a 2.3 KB captcha interstitial on 7 of 60 requests, none of them unproxied or anti-detect-on-a-pinned-exit |
pinterest_pin |
census probe only | 200 with 185 characters of text — excluded, robots.txt disallows the path |
Size separates a block from a form
The two rows at 2.3 KB and 2.5 KB are interstitials: too small to be anything
else, served instead of the requested page, and both replaced by the real page
when the request looked different. The rows at 24.6 KB, 26.2 KB and 52.4 KB are
the size of a working application, and on Louisiana the reconnaissance probe
captured the page's own title (Search for Louisiana Business Filings) and its
session-warning banner from a body of that size.
So the honest reading of Louisiana is that the form was retrieved on all 60 requests at every tier including unproxied, and this study does not know what happens when a search is submitted. That is a smaller claim than "blocked", and it is the one the data supports.
The one thing that is certain
No configuration tested here converts a captcha into a page, and none can. The study's arm totals make the point across all 1,920 requests: challenge outcomes rise with the tier, from 40 unproxied to 84 on residential, while blocked outcomes fall. Paying more moves you further into the defence and no closer to the data.
Run date: 2026-08-18 · All protection systems · All 32 benchmarked targets · Full report · Census data
Test your own target
The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.