How to Test Proxy Quality: Fraud Score, Blacklists, Speed and Leaks

To test proxy quality, run seven checks on every IP before it touches real work: connectivity, exit IP and location, ASN and IP type, blacklist status, fraud score, speed (latency and throughput) and leaks (WebRTC, DNS and headers). A good proxy passes all seven: it connects first time, exits where you paid for, belongs to a real consumer ISP, is listed on no public blocklist, scores at or near zero for fraud, answers quickly and consistently, and never exposes your real IP. This guide walks through each check step by step with free tools and copy-paste commands, and tells you what good numbers look like.

Most proxy problems people blame on "the website" are really quality problems they could have caught in five minutes: an IP that was flagged before you got it, a "US" proxy that geolocates to another state's datacenter, or a browser quietly leaking your home IP through WebRTC. Testing first saves accounts, campaigns and money.

TL;DR

• Seven checks, in order: connect → exit IP → ASN → blacklists → fraud score → speed → leaks.

• Free tools that cover most of it: the CleanProxies proxy checker, IP lookup, IP blacklist checker and WebRTC leak test.

• What "good" looks like: 0 blocklist hits, a fraud score at or near 0, an ASN owned by a consumer ISP, steady latency with no timeouts, and no leaked addresses.

• The quickest way to see a clean result: CleanProxies static ISP proxies are screened to a low-to-zero fraud score, run on Tier-1 US carrier ASNs over 100Gbps ports, and start at as low as $0.75/IP. A $4.99 trial lets you run this entire checklist on real IPs before you buy.

Proxy quality checks at a glance

Why proxy quality matters more every year

Websites now treat every connection as "possibly automated" until proven otherwise, and the IP is the first thing they score. The reason is scale:

Key stats

• 51% of all web traffic in 2024 was automated, the first time in a decade bots outnumbered humans, according to the 2025 Imperva Bad Bot Report (Malwarebytes summary).

• Bad bots alone made up 37% of internet traffic, up from 32% the year before (Imperva via Intelligent CIO).

• In retail, 59% of traffic was bad bots in the same report, which is why e-commerce sites score IPs so aggressively (Intelligent CIO).

• HTTP 407 "Proxy Authentication Required" is defined by the HTTP standard itself and always means the proxy, not the website, rejected you (RFC 9110 §15.5.8, MDN).

When half the internet is bots, anti-fraud systems lean hard on reputation. An IP that someone else abused last month carries that history into your session. That is why the checks below focus as much on reputation as on raw speed.

Before you start: what you need

• Your proxy list in any common format (host:port:user:pass, user:pass@host:port, etc.). If it's in an odd layout, convert it with the proxy list formatter.

• A terminal with curl (built into macOS, Linux and Windows 10+).

• A normal browser window for the leak test, ideally the same browser or anti-detect profile you'll use in production.

• 10 to 15 minutes for a batch of ten IPs.

Test a sample of every order (all IPs if it's small, at least 10% if it's large), and test again whenever something changes: a new subnet, a new target site, or a sudden rise in CAPTCHAs.

Step 1: Confirm every proxy connects

Paste up to ten proxies into the CleanProxies proxy checker. It opens a real tunnel through each proxy over HTTPS (HTTP CONNECT or SOCKS5), reads back the exit IP and reports latency. A proxy passes when the full round trip completes within 8 seconds.

Or test from your own machine:

curl -s -m 10 -x http://USER:PASS@HOST:PORT https://api.ipify.org
# SOCKS5:
curl -s -m 10 -x socks5h://USER:PASS@HOST:PORT https://api.ipify.org

If it prints an IP, the proxy works. If not, read the error:

Field order is the number-one cause of failures: host:port:user:pass and user:pass:host:port are easy to swap. Our guide to cURL, Python and Node.js proxies and the cURL integration page show the exact syntax for each format.

Step 2: Check the exit IP and location

The exit IP is what websites see. For static ISP proxies it is usually the proxy's own address; for rotating residential and mobile gateways it is a different IP behind the gateway, so always test the exit IP, not the gateway host.

1. Take the exit IP from step 1.

2. Paste it into the IP lookup tool and at least one other geolocation database.

3. Confirm the country, and the state or city if you paid for targeting.

Geolocation databases disagree at the city level, so one database saying a neighbouring city isn't a red flag. A "US" proxy showing another country in every database is. If you need US IPs, compare against our United States locations page to see what's available by state.

Step 3: Check the ASN and IP type

The ASN (autonomous system number) identifies the network that routes the IP. It's the fastest way to tell a real ISP proxy from a relabelled datacenter IP.

In the IP lookup tool, look at the ASN and organisation:

• Static ISP / static residential proxy: the org should be a consumer internet provider or carrier, not a hosting or cloud company.

• Mobile proxy: the ASN should belong to a mobile carrier.

• Datacenter proxy: a hosting provider ASN is expected, and fine for workloads that don't need residential trust.

If you were sold "ISP proxies" and the ASN belongs to a cloud provider, that's a datacenter proxy with a new name. Websites check this too: an anti-bot system sees the ASN before anything else. Our explainer on ISP vs residential vs datacenter proxies covers the differences in depth.

CleanProxies ISP proxies are static IPs on Tier-1 US carrier ASNs, so they read as ordinary home connections while running on datacenter-grade hardware with 100Gbps ports.

Step 4: Check public blacklists (DNSBL)

A DNS blocklist (DNSBL) is a public list of IPs seen sending spam, running attacks or showing other abuse. Mail servers, firewalls and anti-bot services query them in real time.

1. Open the IP blacklist checker.

2. Enter the exit IP (IPv4).

3. Read each list: Listed, Not listed or Timed out.

Pass: not listed on any list. One listing on an aggressive list deserves a second look; listings on several lists mean the IP has a real abuse history. For a dedicated IP you'll hold for weeks, ask for a replacement. For accounts and email, never use a listed IP.

Repeat this check over time. Dedicated IPs that only you use stay clean because nobody else's behaviour can land them on a list, which is one of the biggest reasons to choose dedicated ISP proxies over shared pools.

Step 5: Check the fraud score

A fraud score (also called a risk or IP reputation score) is a vendor's estimate of how likely traffic from an IP is to be abusive. It blends blocklist data, proxy/VPN detection, recent abuse reports and the IP's network type. Payment processors, ad platforms and social networks use similar scoring internally.

How to check:

1. Look up the exit IP in two or three public IP reputation services. Scores are vendor-specific, so compare several rather than trusting one.

2. Note the score and any labels such as "recent abuse" or "high risk".

3. Record it next to the IP in your test sheet.

What good looks like:

Bands vary by service; treat them as a guide. The key point: a proxy can be fast and still fail if its reputation is poor. This is exactly why clean IPs matter, which we explain in why clean IP quality matters. CleanProxies screens its ISP IPs before delivery for low-to-zero fraud scores, so you start at the top of that table.

Step 6: Measure speed properly

Single speed tests lie. Measure latency over many requests, look at the slow end (not just the average), and test against the site you'll actually use.

Latency and consistency

Run 20 timed requests through the proxy:

for i in $(seq 1 20); do
  curl -s -o /dev/null -m 15 -x http://USER:PASS@HOST:PORT \
    -w "%{time_connect} %{time_appconnect} %{time_total}\n" https://example.com
done | sort -k3 -n

• time_connect: TCP connect to the proxy.

• time_appconnect: TLS handshake through the tunnel finished.

• time_total: full response.

Look at the median and the slowest 2 lines (roughly the 90th percentile). A good proxy keeps them close together. Big gaps or timeouts mean an overloaded or unstable IP.

Throughput

For bandwidth-heavy jobs, download a large test file and compare with a run without the proxy:

curl -s -o /dev/null -x http://USER:PASS@HOST:PORT \
  -w "%{speed_download}\n" https://speed.cloudflare.com/__down?bytes=50000000

The result is bytes per second. Your own connection is part of the result, so compare it with a direct run, and test from the server that will run the job if possible.

What good speed looks like

CleanProxies ISP proxies run on 100Gbps network ports with <20ms latency and 99.9% uptime, with unlimited bandwidth and threads, so throughput tests don't come with a data bill attached.

Step 7: Test for leaks (WebRTC, DNS and headers)

A perfect IP is worthless if your real address escapes beside it.

WebRTC

1. Turn the proxy on in your browser or anti-detect profile.

2. Open the WebRTC leak test.

3. Pass: WebRTC shows no public address, or only the proxy's address. Fail: your real home IP appears.

Fix it by setting WebRTC to match the proxy in your anti-detect browser (see our setup guides for AdsPower, Multilogin and GoLogin), using an extension that limits WebRTC to the proxied interface, or disabling it (media.peerconnection.enabled = false in Firefox's about:config).

DNS

With SOCKS5, use socks5h:// in cURL (or "proxy DNS" in your client) so hostnames resolve through the proxy, not your local resolver. A DNS leak tells the site's network your real ISP even when the IP is hidden.

Headers and user agent

A proxy changes the IP, not your headers. Check what you send with the user agent checker: default library strings like python-requests or curl get blocked at first sight, and a mobile user agent on a US ISP IP with a desktop screen is an instant mismatch. Keep it consistent: one profile, one user agent, one dedicated IP.

Run a real-target test last

The seven checks tell you the IP is healthy. The final check tells you it works for your job:

1. Send 50–100 requests to your actual target at the speed you'll use in production.

2. Count successes, CAPTCHAs, 403s and 429s.

3. For accounts, log in to one test account per IP and use it normally for a day.

A success rate in the high 90s on a public page and no forced verification on logins means the batch is ready. For workload-specific tips, see web scraping, multi-accounting and ad verification.

What the numbers mean

• Connectivity failures are almost always setup, not quality: field order, protocol or allowlisting.

• Location and ASN are about honesty: if they're wrong, the provider sold you something other than what was advertised.

• Blacklists and fraud score are about history: the biggest predictor of CAPTCHAs, bans and failed logins.

• Speed is about consistency: a steady medium-latency proxy beats a fast one that times out every tenth request.

• Leaks are about your setup: even the cleanest proxy can't protect a browser that announces your real IP.

Which proxies pass these tests best?

The proxies that pass all seven checks most reliably are dedicated static ISP proxies on real carrier ASNs: they keep one IP you alone control (clean history), they sit on consumer-ISP ASNs (they read as home connections), and they're hosted in datacenters (fast and stable).

That's exactly what CleanProxies is built around:

• Cleanest ISP IPs: screened before delivery for low-to-zero fraud scores.

• Tier-1 US carrier ASNs: real consumer-ISP ownership in every IP lookup.

• 100% dedicated IPs, never shared: nobody else's behaviour can put your IP on a blocklist.

• 100Gbps ports, <20ms latency, 99.9% uptime.

• Unlimited bandwidth and threads, HTTP(S) and SOCKS5 with user:pass or IP authentication.

• Instant delivery and 24/7 support that will swap an IP if it ever fails a check.

Need rotation instead? Rotating residential proxies cover 50M+ IPs in 190+ countries with city and state targeting and sticky sessions, and data that never expires. For app and social workflows, 4G/5G mobile proxies give you 10M+ real mobile IPs. Building whole IP ranges? See ISP /24 subnets.

Your proxy testing checklist

Copy this into your test sheet for every new batch:

1. ☐ Every IP shows "Working" in the proxy checker

2. ☐ Exit IP geolocates to the country/state you ordered

3. ☐ ASN belongs to a consumer ISP or carrier (for ISP/mobile proxies)

4. ☐ Not listed on any public blocklist in the blacklist checker

5. ☐ Fraud score at or near 0 in two reputation services

6. ☐ 20-request latency test: steady median, no timeouts

7. ☐ WebRTC leak test shows no real IP; DNS goes through the proxy

8. ☐ User agent and headers match the device and stay consistent

9. ☐ 50–100 requests to the real target with a high success rate

10. ☐ Run all of the above on CleanProxies first with the $4.99 trial: 5 dedicated ISP IPs for 1 hour, or 100 MB. It's the cheapest way to see what a clean result looks like.

CleanProxies pricing

CleanProxies offers the cheapest pricing in the market on clean, dedicated infrastructure:

See every tier on the pricing page, or estimate your bill with the proxy cost calculator. For more on choosing a provider, read how to choose a proxy provider and common proxy mistakes that cause bans, or browse side-by-side comparisons on /compare.

Ready to test clean IPs? Compare plans · Get static ISP proxies · Test your current proxies free

Frequently Asked Questions

Team CleanProxies

Proxy Infrastructure Team

Share