Proxy tier benchmark

Which public web targets actually need a proxy: 32 measured results

Thirty-two public web targets, each fetched through six proxy configurations that differ by one variable at a time, ten rounds per arm, interleaved so the hour of day cannot be confounded with the arm. 1,920 requests, measured 2026-08-18, 15:38–18:09 UTC, from a DigitalOcean droplet in New York. Success is a content assertion: an HTTP 200 carrying a challenge page, an empty body or the wrong page is a failure.

No arm beat the unproxied control. Across all 1,920 requests the six arms span 4.7 percentage points, and direct is at the top of that spread.

Read the twelve "no tier sufficient" rows before quoting them

REPORT.md states that all of the zero-scoring targets are real blocks. Working back from raw.csv for these pages, that does not hold for all of them, and the difference is large enough to publish rather than absorb.

The two false positives and the dead URL share one cause. classify() in harness.py tests the challenge signatures against the response body before it evaluates the content assertion, for every status other than 403, 429, 401/407 and 5xx. Its cloudflare_challenge pattern matches cdn-cgi/challenge-platform, a script Cloudflare injects into ordinary responses; its recaptcha pattern matches g-recaptcha, which is present on any page that embeds a reCAPTCHA widget, including a form that renders perfectly and only challenges on submission; and its generic_captcha pattern matches the literal string captcha anywhere in the body.

So seven of the twelve are blocks the data supports, two are probably the target's own page misfiled, two cannot be settled from the published data, and one is a URL that returns HTTP 404 from Microsoft IIS. Anyone quoting "12 of 32 unreachable at any tier" should quote seven, and say why.

Every benchmarked target

The minimum viable tier is the cheapest arm whose success rate reaches 90%, walking direct → datacenter → datacenter with Anti-Detect → residential. "Best arm" is the highest-scoring arm regardless of cost; where every arm scored 0% the best-arm column is an artefact of tie-breaking and means nothing.

Also published

• The 15 excluded targets and why each was dropped — 11 of them because their robots.txt could not be read
• Protection systems — which portals sit behind Cloudflare, Imperva, DataDome, reCAPTCHA, CloudFront, a JavaScript shell or a tarpit
• The full benchmark report — methodology, arm totals, and what a low-volume single-day run structurally cannot measure
• Harness, target list and all 1,920 raw rows — MIT licensed

---

Test your own target

The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.

Test your target See plans