Proxy tier benchmark › Protection systems
Why do some state registries accept the connection and never answer?
The most interesting defence in this dataset produces no status code, no response body and no error page. The host accepts the connection and never answers. After 20 to 30 seconds the client gives up.
A measurement that records status codes sees nothing here — no 403 to count, no challenge signature to match, no rate-limit header. A scraper without a timeout simply stops. This is the same signature as the largest customer's traffic against an AWS WAF target, and it is the reason this study records transport errors as a first-class outcome rather than discarding them.
Portals behind Tarpit in this census
Sixty-one candidate URLs were probed once each from a clean US datacenter IP on 2026-08-18; 2 of the portals below were then measured through all six proxy arms, ten rounds each.
| Portal | Measured in | Behaviour |
|---|---|---|
us_mo_sos_biz |
six-arm run | 10 of 10 unproxied requests hung to the 30 s ceiling with zero bytes; proxied requests were answered — 403, or a 4.3 KB HTTP 200 that is not the search page |
us_ne_corpsearch |
six-arm run | 10 of 10 unproxied requests hung to the 30 s ceiling; through a proxy the same host answered in about a second with a 26 KB reCAPTCHA page |
us_tn_bear |
census probe only | ConnectTimeout after 30 s from both User-Agents — excluded, robots.txt unreadable |
The tarpit is applied to the address, not to the request
Nebraska is the clean demonstration. Ten unproxied requests hung for 30 seconds and returned zero bytes. The same URL, in the same three-hour window, answered proxied requests in about a second — with a reCAPTCHA, which is not progress you can use, but which identifies the mechanism. Change the exit address and the host answers.
Missouri shows the same thing with a different second act: unproxied requests hang, plain datacenter requests get an HTTP 200 of 4,319 bytes that is not the search page, and every fingerprinted request gets a 6,115-byte HTTP 403. Three tiers, three different refusals, and the ladder runs backwards — the cheapest proxied configuration got the most content.
Three census rows do not belong to this signature
PROTECTION-CENSUS.md groups six hosts as tarpits: Nebraska, Missouri,
Tennessee, Wisconsin, Ohio and Oklahoma. The probe data separates them.
Nebraska, Missouri and Tennessee timed out. Wisconsin and Ohio failed DNS
resolution (Temporary failure in name resolution) and Oklahoma failed TLS
certificate verification (CERTIFICATE_VERIFY_FAILED). At least one of those
three may be the benchmark host rather than the target, and none of them is
evidence of anti-bot behaviour.
Virginia deserves a mention here too. The licence-lookup path
dhp.virginia.gov/lookup/ recorded a ConnectTimeout during reconnaissance, so
the department homepage was benchmarked instead. The one observation this study
holds about the Virginia lookup endpoint is a 30-second timeout that was never
followed up.
Practical note
Set a timeout on every request, and record transport failures as a distinct outcome rather than folding them into a retry loop. A target that hangs looks identical to a slow network until you count how often it happens and to which exits.
Run date: 2026-08-18 · All protection systems · All 32 benchmarked targets · Full report · Census data
Test your own target
The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.