Proxy tier benchmark › Targets

Does the Colorado business entity search block datacenter proxies?

State business entity registries · minimum viable tier: no tier sufficient · measured 2026-08-18

It blocks everything, but it blocks the tiers differently. Unproxied and datacenter requests were refused with HTTP 403; anti-detect and residential requests were answered HTTP 200 carrying an interactive Cloudflare challenge. All six arms scored 0% across 60 requests. Measured 2026-08-18.

What was measured
URL https://www.sos.state.co.us/biz/BusinessEntityCriteriaExt.do
Content assertion Business Entity — never verified against a live page
Arms 6
Rounds per arm 10
Requests 60
Measured 2026-08-18, 15:38–18:09 UTC
Benchmark host DigitalOcean droplet, New York (nyc3)

A request counts as a success only if the expected content is present. An HTTP 200 carrying a challenge page, an empty body or the wrong page is a failure, because it is not a page you can use.

This measures whether a tier works, not long-run stability under sustained load. Ten requests per arm, at a two-second floor, never approach a per-IP rate limit — which is the thing a rotating pool exists to defeat.

Results by arm

Arm Success p50 p95 Bytes per success Outcomes
direct (no proxy) 0% 90 ms 103 ms n/a blocked 10
datacenter, one pinned exit 0% 409 ms 1,195 ms n/a blocked 10
datacenter, rotating exit 0% 513 ms 1,333 ms n/a blocked 10
anti-detect, one pinned exit 0% 1,151 ms 1,493 ms n/a challenge 9, blocked 1
anti-detect, rotating exit 0% 1,131 ms 2,277 ms n/a challenge 8, blocked 2
residential, rotating exit 0% 1,596 ms 3,538 ms n/a challenge 10

What protects this target

Cloudflare, in two modes, and this target is the study's clearest single illustration of what the proxy ladder actually buys.

Thirty-three of the 60 requests — including every unproxied one and every plain datacenter one — returned HTTP 403 with a 5,486-5,490 byte body. The probe captured its title, Attention Required! | Cloudflare, and its text, "Sorry, you have been blocked. You are unable to access...".

The anti-detect and residential arms were answered HTTP 200 with a 14,775-14,778 byte interactive challenge instead, on twenty-seven of thirty requests. Across the whole study this is the pattern in aggregate: as the tier climbs, blocked outcomes fall and challenge outcomes rise, monotonically, from 50 blocked / 40 challenged on the unproxied arm to 20 blocked / 84 challenged on residential.

Nothing converts a challenge into a page. A plain HTTP client cannot solve an interactive challenge at any tier or price, so the extra spend moved this target from one kind of nothing to another. The binding constraint on this target is the challenge, and the tool for a challenge is a real browser — see the Browser API — not a more expensive exit.

robots.txt status

The URL measured is allowed by the host's robots.txt.
Status allowed
File https://www.sos.state.co.us/robots.txt
Crawl-delay not declared
Fetched as the benchmark's own User-Agent
Note robots.txt 3086 bytes via benchmark_ua

Limits of this result

  • The content assertion was never verified against a live page. It does not affect the result: 403s are classified from the status code and the 200s carry Cloudflare's own challenge markup.
  • The search page was measured, not a submitted query.
  • Ten rounds per arm in a single three-hour window on 2026-08-18. Anti-bot behaviour drifts; a result older than a few months is a historical record, not a current one.
  • One exit geography. Every request left from a US datacenter host or a US exit, so nothing here describes how this target answers traffic from elsewhere.
  • The unproxied arm ran from a clean, previously unused cloud IP with no accumulated reputation. It is a best case a production scraper will not sustain.

Run date: 2026-08-18 · Full benchmark report · Harness and raw data · All 32 targets

The 60 rows behind this page are in results/six-arm/raw.csv; filter them with grep '^[^,]*,us_co_sos_biz,' raw.csv.

Test your own target

The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.

Test your target See plans