Proxy tier benchmark › Targets
Why does the Nebraska corporate search time out, and does a proxy fix it?
State business entity registries · minimum viable tier: no tier sufficient · measured 2026-08-18
A proxy changes the failure but does not fix it. All ten unproxied requests hung and timed out after 30 seconds without a response; through datacenter, anti-detect and residential exits the same host answered in about a second with a 26,240-byte reCAPTCHA page. Every arm scored 0%. Measured 2026-08-18.
What was measured
| URL | https://www.nebraska.gov/sos/corp/corpsearch.cgi |
| Content assertion | Corporate|Business — never verified against a live page |
| Arms | 6 |
| Rounds per arm | 10 |
| Requests | 60 |
| Measured | 2026-08-18, 15:38–18:09 UTC |
| Benchmark host | DigitalOcean droplet, New York (nyc3) |
A request counts as a success only if the expected content is present. An HTTP 200 carrying a challenge page, an empty body or the wrong page is a failure, because it is not a page you can use.
This measures whether a tier works, not long-run stability under sustained load. Ten requests per arm, at a two-second floor, never approach a per-IP rate limit — which is the thing a rotating pool exists to defeat.
Results by arm
| Arm | Success | p50 | p95 | Bytes per success | Outcomes |
|---|---|---|---|---|---|
| direct (no proxy) | 0% | 30,166 ms | 30,176 ms | n/a | error 10 |
| datacenter, one pinned exit | 0% | 15,386 ms | 16,065 ms | n/a | challenge 2, error 8 |
| datacenter, rotating exit | 0% | 15,311 ms | 15,777 ms | n/a | challenge 4, error 6 |
| anti-detect, one pinned exit | 0% | 15,728 ms | 19,147 ms | n/a | challenge 3, server error 7 |
| anti-detect, rotating exit | 0% | 15,439 ms | 17,736 ms | n/a | challenge 5, server error 5 |
| residential, rotating exit | 0% | 2,480 ms | 19,051 ms | n/a | challenge 9, server error 1 |
What protects this target
A tarpit for direct traffic, a captcha for everything else.
The unproxied arm's ten requests each ran to the harness's 30-second ceiling
with a ReadTimeout and a zero-byte response: the connection was accepted and
never answered. PROTECTION-CENSUS.md flags this signature on five state hosts
— Nebraska, Missouri, Tennessee, Wisconsin and Ohio — and makes the point that
matters most here: a status-code-only measurement records nothing at all.
There is no 403 to count, no challenge page to fingerprint, and a scraper
without a timeout simply stops.
Through a proxy the host behaves differently. Twenty-three of 60 requests returned a byte-identical 26,240-byte reCAPTCHA page, in a median of around a second on the residential arm, and the remaining failures were split between transport timeouts on the datacenter arms and HTTP 502s on the anti-detect and residential arms. So the tarpit is applied to the requesting address, not to the request: change the exit and the same URL answers promptly.
That identifies the mechanism without offering a route through it. Converting a 30-second hang into a reCAPTCHA is diagnostic progress and nothing more; no HTTP client solves a reCAPTCHA at any tier.
robots.txt status
The URL measured is allowed by the host's robots.txt.
| Status | allowed |
| File | https://www.nebraska.gov/robots.txt |
| Crawl-delay | not declared |
| Fetched as | the benchmark's own User-Agent |
| Note | robots.txt 97 bytes via benchmark_ua |
Limits of this result
- The content assertion for this target was never verified against a live page. The 26,240-byte body was classified by its reCAPTCHA signature before the assertion ran, so it is not established whether that body is a challenge page or the search form with a reCAPTCHA widget on it — the same ambiguity documented for Iowa and Louisiana.
- The search page was measured, not a submitted query.
- Ten rounds per arm in a single three-hour window on 2026-08-18. Anti-bot behaviour drifts; a result older than a few months is a historical record, not a current one.
- One exit geography. Every request left from a US datacenter host or a US exit, so nothing here describes how this target answers traffic from elsewhere.
- The unproxied arm ran from a clean, previously unused cloud IP with no accumulated reputation. It is a best case a production scraper will not sustain.
Related
- Public records scraping
- Does the Louisiana business filings search block scrapers?
- Why does the Missouri business search fail, and can a proxy get through?
- Do you need residential proxies for the Arkansas business entity search?
- Proxy tier benchmark: full report
Run date: 2026-08-18 · Full benchmark report · Harness and raw data · All 32 targets
The 60 rows behind this page are in results/six-arm/raw.csv; filter them with grep '^[^,]*,us_ne_corpsearch,' raw.csv.
Test your own target
The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.