Proxy tier benchmark › Targets

Can a proxy get past the Utah business entity search block?

State business entity registries · minimum viable tier: no tier sufficient · measured 2026-08-18

No tier tested retrieved the page, and the more expensive tiers bought eleven times more traffic to fail differently. Unproxied and datacenter requests were refused with HTTP 403 and a 4.5 KB Cloudflare block page; anti-detect and residential requests received HTTP 200 with a 52,406-byte body carrying a captcha. All six arms scored 0%. Measured 2026-08-18.

What was measured
URL https://secure.utah.gov/bes/
Content assertion Business Entity|Business Search — never verified against a live page
Arms 6
Rounds per arm 10
Requests 60
Measured 2026-08-18, 15:38–18:09 UTC
Benchmark host DigitalOcean droplet, New York (nyc3)

A request counts as a success only if the expected content is present. An HTTP 200 carrying a challenge page, an empty body or the wrong page is a failure, because it is not a page you can use.

This measures whether a tier works, not long-run stability under sustained load. Ten requests per arm, at a two-second floor, never approach a per-IP rate limit — which is the thing a rotating pool exists to defeat.

Results by arm

Arm Success p50 p95 Bytes per success Outcomes
direct (no proxy) 0% 490 ms 666 ms n/a blocked 10
datacenter, one pinned exit 0% 1,277 ms 3,400 ms n/a blocked 10
datacenter, rotating exit 0% 802 ms 3,643 ms n/a blocked 10
anti-detect, one pinned exit 0% 2,738 ms 3,649 ms n/a challenge 10
anti-detect, rotating exit 0% 1,332 ms 4,923 ms n/a challenge 10
residential, rotating exit 0% 3,600 ms 4,901 ms n/a challenge 10

What protects this target

Cloudflare, with a price attached to the difference.

Thirty requests — unproxied, pinned datacenter and rotating datacenter — were refused with HTTP 403 and a body of 4,562-4,566 bytes. The reconnaissance probe captured the title Attention Required! | Cloudflare and the text "Sorry, you have been blocked".

The other thirty — anti-detect on both session modes, and residential -- received HTTP 200 with a byte-identical 52,406-byte body on every single request, matching a captcha signature. That is eleven times the traffic of the 403 for a page that is equally unusable, and on a metered plan you pay for all of it. Anyone budgeting a collection run against a challenged target should price the failures, not just the successes.

One caveat this page will not paper over. The 52,406-byte body was matched by the harness's generic captcha rule, which fires on the literal string captcha anywhere in the response. A 52 KB page is large enough to be the real search application with a captcha script on it, and the reconnaissance probe never retrieved a live copy to compare against, because it was blocked too. So 0% on the anti-detect and residential arms is what the harness recorded, and this study cannot rule out that those thirty requests reached the page.

robots.txt status

The URL measured is allowed by the host's robots.txt.
Status allowed
File https://secure.utah.gov/robots.txt
Crawl-delay not declared
Fetched as the benchmark's own User-Agent
Note robots.txt 14 bytes via benchmark_ua

Limits of this result

  • The anti-detect and residential result rests on a generic captcha signature matching the word captcha in a 52 KB body. It is not established that those responses were challenge pages rather than the search application. Treat Utah as unresolved above the datacenter tier.
  • The search page was measured, not a submitted query.
  • Ten rounds per arm in a single three-hour window on 2026-08-18. Anti-bot behaviour drifts; a result older than a few months is a historical record, not a current one.
  • One exit geography. Every request left from a US datacenter host or a US exit, so nothing here describes how this target answers traffic from elsewhere.
  • The unproxied arm ran from a clean, previously unused cloud IP with no accumulated reputation. It is a best case a production scraper will not sustain.

Run date: 2026-08-18 · Full benchmark report · Harness and raw data · All 32 targets

The 60 rows behind this page are in results/six-arm/raw.csv; filter them with grep '^[^,]*,us_ut_bes,' raw.csv.

Test your own target

The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.

Test your target See plans