Proxy-Scraper Test Finds 1 in 5 Free Proxies Inject Scripts

Of 270 free proxy servers that passed basic authenticity checks in a test published Sept. 26, 54 rewrote the pages they were supposed to relay untouched, most often by inserting a hidden script tag pointing at another server.

The test, run by a developer using the handle Maxi with an open-source tool called proxy-scraper, started from roughly 1 million candidate proxy addresses pulled from more than 700 public lists. Only 270 survived an initial handshake check and a honeypot filter designed to weed out proxies that behave differently when they think they are being tested. Of those 270, 20 percent modified the content passing through them.

How the funnel narrows from a million candidates to 270

Stage	Count	Share of prior stage
Candidate addresses scraped	1,000,000	--
Passed handshake and honeypot checks	270	0.03%
Rewrote page content	54	20%

What the injected code does

"Almost always an injected <script src="http://…">, sometimes ads," Maxi wrote of the 54 proxies caught modifying traffic. A proxy in that position sits between a user and every site the user visits over it, so a script it inserts can run in the context of pages the user trusts, log form submissions, or serve code the destination site never wrote. Maxi's data also found 52 percent of the working proxies exiting from datacenter IP ranges rather than residential connections, and 28 percent already listed on the SpamCop blocklist, a sign the same infrastructure had been flagged for abuse before this test ever touched it.

A slower, larger study found the same thing in 2024

A peer-reviewed paper presented at the Workshop on Measurements, Attacks, and Defenses for the Web, co-located with NDSS 2024, analyzed 640,600 proxies collected from 11 providers over 30 months. It found 16,923 proxies, about 2.6 percent of the total, altering traffic in ways the authors said suggested malicious intent by the proxy operators, plus 4,452 distinct vulnerabilities across proxy IP addresses, including 1,755 that would let an attacker run remote code on the proxy itself.

The 2.6 percent figure looks smaller than 2026's 20 percent, but the two studies measure different populations: the 2024 paper's denominator includes proxies that never worked at all, while Maxi's 20 percent is a share of only the proxies that had already passed a working-proxy filter. Read against a comparable base, that is not the same finding restated four years apart so much as it is the same failure mode showing up again at a comparable rate among proxies healthy enough to be worth testing.

Why free proxies keep failing this test

The 2024 study found 42,206 of its proxies were running on MikroTik routers, the same brand behind a router operating system CISA added a fourth exploited flaw to on Sept. 25. A device compromised for one purpose, such as cryptomining or botnet participation, can be resold or repurposed as a public proxy without its owner's knowledge, which is one reason free-proxy lists point at hardware nobody is actively managing. The same overlooked-network-gear pattern shows up in CISA's list of 14 unfixed flaws in a consumer dashcam: cheap, unmanaged devices end up running someone else's infrastructure long before their owners notice.

The proxies themselves are frequently vulnerable, not just abused

Content injection was not the only problem the 2024 study documented. Across its 640,600 proxies, the researchers found 4,452 distinct vulnerabilities on the proxy machines themselves: 1,755 that would let an outside attacker run their own code on the proxy, and 2,036 that would let an attacker already on the box escalate to higher privileges. That distinction matters for anyone routing traffic through one of these addresses: the risk is not only that the proxy operator may be reading or altering what passes through, but that a third party who compromised the proxy through one of those 4,452 holes could be doing the same thing without the operator's knowledge. The study's proxies were concentrated in the United States and China, and only 34.5 percent of the full 640,600 were active even once across the entire 30-month collection window, evidence the authors cited that most free proxy infrastructure is unstable as well as unmonitored.

Who actually uses these lists

Free proxy lists circulate mainly among people who need a large, disposable pool of IP addresses rather than one reliable connection: web scrapers rotating requests to avoid a rate limit, ad-verification tools checking what a campaign looks like from another country, and users working around a geographic block on a video or shopping site. None of those uses are well served by a proxy that rewrites the page it is supposed to relay, since a scraper that ingests injected script tags is collecting corrupted data without knowing it, and a user checking a blocked page has no way to tell a real page from one with an extra script bolted onto it.

What this doesn't cover

Both studies measure proxies rewriting plaintext HTTP content. Injecting a script into a page requires the ability to modify what actually reaches the browser, something a proxy cannot do to a properly configured HTTPS connection without also breaking that connection's certificate validation. Neither study is evidence that paid VPN services or HTTPS-only browsing carry the same risk; the exposure documented here is specific to free HTTP proxies and to sites a user still reaches without encryption. The MADWeb'24 authors' own conclusion, after 30 months of measurement, was to advise against using free proxies at all rather than to recommend a way to pick a safer one.