Solutions › Property & real-estate data

Scraping property and real-estate data

Property data comes from two very different kinds of source, and most pipelines need both: listing portals, which are modern sites behind commercial WAFs, and county assessor, recorder, and land-record systems, which hold the official ownership, valuation, and transfer data but are often older, slower, and hidden behind a challenge page. Rotating datacenter IPs with a browser-like fingerprint and a US exit handle both, because the real obstacle in each case is a per-address request budget and a generic WAF — not serious bot detection.

Two different sources, one pipeline

  • Listing portals and brokerage sites — active inventory, asking prices, days on market, photos, agent details.
  • County assessors — parcel records, assessed values, tax rolls, characteristics, exemptions.
  • County recorders and land registries — deeds, mortgages, liens, transfer history.
  • Permit and code-enforcement portals — construction activity and property condition signals.
  • Real-estate licensing commissions — agent and broker verification.

The government half of this list works exactly like the rest of the public-records world, and the details are on the public records and government registries page. This page covers the property-specific side.

County records: what actually blocks you

There's no national property database in the United States — there are thousands of county systems. We tested 50 US state and federal public-data URLs from a clean US datacenter IP, and only 36% returned usable content. The blockers were all off-the-shelf products, not custom defenses: Cloudflare challenges (FL, CO, NC, IA, GA), a Cloudflare hard block (UT), Imperva/Incapsula (MA, NV), DataDome (AK), reCAPTCHA (LA), a CloudFront 403 (AR), and plain connection timeouts (NE, MO, TN, WI, OK, OH).

Two failure modes are worth planning for. One state real-estate commission returned HTTP 202 with an empty body — a soft block that any status-code check counts as a success, leaving you with rows that look fine but are empty. And timeouts here are often real: county systems can be genuinely slow rather than hostile, so a short client timeout will create failures that a patient one wouldn't.

US targets need US exits

Location is checked before fingerprinting. In our test, two state sites served a US datacenter IP normally and returned 403 to a European IP for the same request. Counties are even more restrictive than states. If you're collecting US property data from servers in Europe or Asia, exit from the US — and use a state-level location when the portal is regional:

pxu1000-0+US+county-batch-11
pxu1000-0+us-fl+county-batch-11    # Florida exit for a Florida county system

Listing portals

The commercial side of property data works like the rest of the modern web: a WAF that checks TLS fingerprints, a per-IP request budget, and content rendered client-side. None of this needs residential IPs — it needs a browser-shaped fingerprint and enough distinct addresses to keep each one under the budget. What it does need is attention to terms of service — listing data is often licensed, and MLS-derived content usually has explicit redistribution rules. Check what you're allowed to store and republish before scaling a crawl, not after.

How to rotate correctly

Rotation doesn't happen automatically. Every request through BotProxy runs inside a session, and a session keeps one exit IP for its lifetime. If you don't set a session ID, a single default session is used and every request goes out from the same address. The session ID is the last field of the proxy login:

login + location + SESSIONID

Change the session ID to change the IP. A session is dropped after 5 minutes of inactivity, and limit_session_age caps its total lifetime — 60 seconds on most credentials, or 0 for no cap.

What that means for property work:

  • Keep one session for a parcel lookup sequence — search form, result list, detail page, document image — because these systems carry server-side state and will drop you if the IP changes mid-sequence. Raise limit_session_age on the credential you use for them.
  • Rotate between parcels, and rotate per county, so no single address builds up too much volume against one system.
  • Request rate is the real constraint. Across 268 targets in our production traffic, 28 showed failure rates climbing sharply when too many requests came from too few IPs. Spreading the work is what keeps a county crawl running.

Anti-Detect Mode

Anti-Detect Mode rewrites your client's TLS and HTTP/2 handshake to match a real browser. It's what gets past the WAF-based blocking listed above — AWS WAF, Imperva, and Cloudflare fingerprint checks. It's on by default. Because it works as a man-in-the-middle, your client needs to accept the proxy's certificate, and the browser profile supplies the User-Agent, replacing the one your client sends.

Postback forms, map searches, and PDFs

County systems are where the web's oldest technology still lives: ASP.NET postback navigation, frames, session-bound pagination, and documents served only as scanned PDFs. Listing portals have the opposite problem — map-driven single-page apps with no server-rendered content at all. Both are handled by the cloud Chrome workers included with every plan: fill the form, page through results, download the document, take a screenshot. Same account, same IP pool, same bill. See the Browser API reference.

Look for a bulk extract before writing a crawler

Many counties publish assessor and parcel data as downloadable extracts, ArcGIS or Socrata endpoints, or records requests that cost less than a week of engineering. Those files are more complete and more reliable than anything scraped from a search UI. Outside the US, data.gov.uk and OpenStreetMap cover a lot of the same ground. Scrape the counties that don't publish anything, the fields the extract leaves out, and the daily changes a quarterly file can't give you.

Where this won't work

Portals behind a Cloudflare managed challenge, anything that requires an agent login or MLS credentials, and data whose license forbids redistribution aren't jobs for a rotating proxy. The rest — slow county systems, WAF interstitials, geo-gates, and per-IP rate limits — is ordinary work.


Try it on your target

Paste your URL into the live tester and see the real response before creating an account. Every plan includes all locations, Anti-Detect Mode, and the Browser API. You're billed on traffic volume only.

Test your target See plans Read the documentation

Measured results for targets like these

From our published proxy tier benchmark: what each of these targets actually required, measured rather than asserted.

Other use cases

Public records & government registries

Licensing boards, Secretary of State business registries, county assessors and recorders. About 1,450 separate government domains, each with its own stack and its own WAF.

B2B data & business directories

Company and professional profiles, directories, and firmographic enrichment — long-running pipelines that re-check the same records on a schedule.

E-commerce price & catalog monitoring

Marketplace and retailer product pages, price history, and stock tracking across many sites at once.

SEO & SERP rank tracking

Search result pages by keyword and locale, rank monitoring, and share-of-voice reporting for agencies and in-house teams.

Travel & airline fare monitoring

Airline and OTA fare and availability checks, where the price depends on the country the request comes from.

Property & real-estate data

Listing portals plus the county assessor, recorder, and land-record sources that hold the official ownership and tax data.

Brand protection & counterfeit monitoring

Marketplace listings and product images collected on a schedule to find copies of your products and document them for takedowns.