Proxy tier benchmark › Targets
Is the Iowa Secretary of State business search blocked by Cloudflare?
State business entity registries · minimum viable tier: no tier sufficient · measured 2026-08-18
The benchmark says yes, and the benchmark is probably wrong. All 60 requests returned HTTP 200 and were classified as Cloudflare challenges, giving 0% on all six arms — but the bodies are 100,215-100,291 bytes and carry the Iowa Secretary of State's own page title and opening text. This page reports the measurement and the reason to distrust it. Measured 2026-08-18.
What was measured
| URL | https://sos.iowa.gov/search/business/search.aspx |
| Content assertion | Business Entities — never verified against a live page |
| Arms | 6 |
| Rounds per arm | 10 |
| Requests | 60 |
| Measured | 2026-08-18, 15:38–18:09 UTC |
| Benchmark host | DigitalOcean droplet, New York (nyc3) |
A request counts as a success only if the expected content is present. An HTTP 200 carrying a challenge page, an empty body or the wrong page is a failure, because it is not a page you can use.
This measures whether a tier works, not long-run stability under sustained load. Ten requests per arm, at a two-second floor, never approach a per-IP rate limit — which is the thing a rotating pool exists to defeat.
Results by arm
| Arm | Success | p50 | p95 | Bytes per success | Outcomes |
|---|---|---|---|---|---|
| direct (no proxy) | 0% | 177 ms | 201 ms | n/a | challenge 10 |
| datacenter, one pinned exit | 0% | 680 ms | 3,139 ms | n/a | challenge 10 |
| datacenter, rotating exit | 0% | 1,103 ms | 2,480 ms | n/a | challenge 10 |
| anti-detect, one pinned exit | 0% | 1,204 ms | 2,389 ms | n/a | challenge 10 |
| anti-detect, rotating exit | 0% | 461 ms | 2,606 ms | n/a | challenge 10 |
| residential, rotating exit | 0% | 1,884 ms | 3,075 ms | n/a | challenge 10 |
What protects this target
A Cloudflare script, on what appears to be the real page.
Every one of the 60 requests returned HTTP 200 with a body of
100,215 or 100,291 bytes. The reconnaissance probe fetched the same URL and
recorded a 100,215-byte response with the title Business Entities Search
and text beginning "Business Entities Search This is the official website of
the Iowa Secretary of State...". A Cloudflare interstitial is a few kilobytes
and carries Cloudflare's own copy; the Colorado challenge measured in the same
run is 14,777 bytes.
The mechanism is a harness defect. classify() in harness.py tests the
challenge signatures against the body before it evaluates the content
assertion, and the cloudflare_challenge pattern matches
cdn-cgi/challenge-platform — a script Cloudflare injects into ordinary
responses when JavaScript detection is enabled, not only into challenge pages.
The content assertion for this target is Business Entities, which is present
in the probe's captured text. Had the assertion been evaluated, these requests
would have scored as successes.
What that means for the published totals. REPORT.md states that all eleven
zero-scoring targets are real blocks, on the grounds that they fail via
signature or status code independently of the assertion. That reasoning does
not hold for this target: the signature itself is the thing in doubt. Iowa
should be treated as unresolved, not as blocked.
robots.txt status
The URL measured is allowed by the host's robots.txt.
| Status | allowed |
| File | https://sos.iowa.gov/robots.txt |
| Crawl-delay | not declared |
| Fetched as | the benchmark's own User-Agent |
| Note | robots.txt 3863 bytes via benchmark_ua |
Limits of this result
- This page states a defect in the measurement, not a pass rate. Nothing here establishes that the Iowa search can be collected — only that the evidence it cannot is unsound.
- Resolving it needs a fresh fetch that records whether the body contains a challenge form or the search page. That was not re-run for this write-up; the published data is the source here.
- Ten rounds per arm in a single three-hour window on 2026-08-18. Anti-bot behaviour drifts; a result older than a few months is a historical record, not a current one.
- One exit geography. Every request left from a US datacenter host or a US exit, so nothing here describes how this target answers traffic from elsewhere.
- The unproxied arm ran from a clean, previously unused cloud IP with no accumulated reputation. It is a best case a production scraper will not sustain.
Related
- Public records scraping
- Does the Colorado business entity search block datacenter proxies?
- Is the North Carolina business registration search blocked to scrapers?
- Can a proxy get past the Utah business entity search block?
- Proxy tier benchmark: full report
Run date: 2026-08-18 · Full benchmark report · Harness and raw data · All 32 targets
The 60 rows behind this page are in results/six-arm/raw.csv; filter them with grep '^[^,]*,us_ia_sos_biz,' raw.csv.
Test your own target
The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.