Every proxy vendor sells the same three sentences: a pool size in the millions, an uptime figure with a decimal point, and the word "residential". None are measured by anyone except the vendor. Two can advertise five million IPs while one hands you the same four hundred addresses all week.
The useful skill is not picking the better-sounding vendor, but turning a claim into a number your script can falsify.
Pool size means at least four different things
"5M IPs" can mean any of these, with a gap of two orders of magnitude between them:
- Cumulative addresses ever seen — everything routed since launch, often already burned.
- Unique addresses served per hour — closer to reality, still inflated by churn.
- Concurrent addresses available now — the pool you can draw from while sessions live.
- Distinct /24 blocks and ASNs — the only figure that predicts whether two sessions look like neighbours.
Only the last two change outcomes: a million addresses inside forty ASNs is a smaller pool than twenty thousand spread across four thousand, if your problem is correlation rather than volume.
What to measure, and how to falsify it
| Vendor claim | Number that actually constrains you | How to falsify it |
|---|---|---|
| "Millions of IPs" | Unique exits per hour, distinct /24s | Sample 200 sessions, count distinct IPs and prefixes |
| "99.9% uptime" | Success rate of a full request, not a TCP connect | Fetch a small payload through the proxy, score HTTP 200 |
| "Residential" | ASN class of the exit, not the product name | Resolve each exit IP to its ASN and check the holder type |
| "Unlimited concurrency" | Success rate as you raise parallel sessions | Ramp 4 → 16 → 64 workers, watch failure mode |
| "Fast nodes" | Time to first byte of a real request | Time the request body, not a ping |
Measure the end-to-end operation: a 40 ms handshake proves nothing about a request that dies at TTFB.
A harness small enough to trust
Standard library only. It reads host:port lines, performs a real SOCKS5 handshake, requests a plain-text echo endpoint, and records the exit IP, latency, and prefix key. Concurrency stays low on purpose: hammering a trial endpoint is the fastest way to get your test IP blocked.
```pythonimport socket, struct, time
from concurrent.futures import ThreadPoolExecutor
def socks5_get(ep, host="api.ipify.org"):
h, p = ep.split(":")
t0 = time.time()
s = socket.create_connection((h, int(p)), timeout=8)
s.sendall(b"\x05\x01\x00") # greeting: no auth
if s.recv(2) != b"\x05\x00":
raise OSError("method rejected")
q = host.encode()
s.sendall(b"\x05\x01\x00\x03" + bytes([len(q)]) + q + struct.pack(">H", 80))
rep = s.recv(4)
if rep[1]:
raise OSError("connect failed rep=%d" % rep[1])
s.recv({1: 4, 4: 16}.get(rep[3], s.recv(1)[0] + 1) + 2) # drain BND.ADDR
s.sendall(("GET / HTTP/1.1\r\nHost: %s\r\nConnection: close\r\n\r\n" % host).encode())
data = b""
while chunk := s.recv(4096):
data += chunk
s.close()
ip = data.rsplit(b"\r\n\r\n", 1)[-1].decode().strip()
return {"exit": ip, "ms": round((time.time() - t0) * 1000),
"prefix": ".".join(ip.split(".")[:3])}
def one(ep):
try:
return socks5_get(ep)
except Exception as e:
return {"exit": None, "err": type(e).name} # failures are data
eps = [l.strip() for l in open("proxies.txt") if l.strip()]
with ThreadPoolExecutor(max_workers=4) as pool:
rows = [r for r in pool.map(one, eps) if r.get("exit")]
Write every row to JSONL as you go: a sample you cannot re-analyse is one you pay for twice.
## Designing the sample so the result means something
**Sample across time, not once.** Run the harness in three windows (morning, evening, late night in the target market's timezone). Vendors oversubscribe; the 03:00 pool is not the 21:00 pool.
**Size the sample for the claim under test.** Two hundred attempts give a success rate with a ±6 point confidence interval — enough to separate 85% from 98%, useless for 98.5% versus 99.3%. The second decimal is unverifiable in an afternoon; price it as such.
**Count unique exits, not requests.** The ratio of distinct exit IPs to successful requests is the most diagnostic number in the sample. Below 0.5 you are buying a static pool dressed up as rotating; near 1.0 with high ASN diversity, the claim has substance.
## Reading the result
| Observation | Likely cause | What to do |
|---|---|---|
| High connect success, low request success | Exit rate-limited or gateway swapping mid-session | Re-test with sticky sessions; read refund terms |
| Distinct exits high, distinct /24s low | Single-housing provider | Judge by correlation risk, not pool size |
| Failure rate rises sharply above 16 workers | Undisclosed concurrency cap | Price the real concurrent capacity |
| HTTP 403 only on the target site | Target-side fingerprinting, not proxy health | Change exit class, not vendor |
None of these verdicts need the vendor's cooperation, and all fit a diffable JSONL file.
## Five mistakes that invalidate the test
1. **Measuring at one in the morning.** Low-load conditions flatter every provider.
2. **Counting retries as successes.** Log the first attempt separately or your uptime figure is fiction.
3. **Using ping instead of a payload.** ICMP never touches the exit's egress path or rate limiter.
4. **Not recording the exit IP.** Round-robin pools then hide dead nodes behind good results.
5. **Testing against a site that blocks datacenter ranges.** You measure its policy, not vendor quality.
## FAQ
**How many endpoints do I need for a trustworthy audit?**
Two hundred attempts per window is a practical floor; below fifty, one bad node swings the average by several points. Sample randomly, not the first N entries.
**Does a failed handshake always mean a dead proxy?**
No. `REP=0x05` usually means the destination is blocked from the exit, while a greeting-stage timeout points at the proxy itself — which tells you whether to ask for a new node or a new region.
**Can I audit a vendor without buying first?**
Usually yes; most offer trial credit. Spread the sample across the window rather than spending it in ten minutes, and keep the JSONL so later tests stay comparable.
**What if the numbers are simply unverifiable?**
Treat them as absent and decide on what you can measure: request success and exit diversity. A provider that will not let you sample either has answered the question for you.
If you want this audit applied to concrete platforms — IP class, tool pairing, and which vendor fits cross-border marketing versus multi-account work — the [2026 proxy IP evaluation on socks5ip.com.cn](https://socks5ip.com.cn/zuixinzixun/jingxuanzixun/2026niandailiippingce/) walks through the comparison per scenario, and its [proxy knowledge base](https://socks5ip.com.cn/daili-ip-zhishiku/) covers the underlying concepts.
Top comments (0)