How to Spot a Fake Proxy Provider Before You Pay

If you only have ten minutes, run these. A vendor that fails two of them is not worth a trial, no matter how good the landing page looks.

The rest of this article is how to run each check properly, because the naive version of every one of them produces false positives.

"Fake" covers four different problems, and they carry very different risk. Naming the one in front of you tells you whether to walk away or just renegotiate.

The reseller case is the most common and the least discussed. Reselling is legal and sometimes genuinely useful: better onboarding, regional billing, a nicer dashboard. The problem is an undisclosed reseller, because you inherit every limitation of the upstream network plus a support layer that cannot escalate. Our breakdown of whitelabel and reseller proxy networks covers how those arrangements are structured and what they cost you.

The seized case is not theoretical. As of September 2026, the residential proxy vendor NetNut's domain netnut.io resolves to nameservers ns1.fbi.seized.gov and ns2.fbi.seized.gov. Anyone can confirm that in one command:

dig +short NS netnut.io

That is the cheapest due diligence available, and almost nobody runs it. Before sending money to any provider, resolve its nameservers and confirm the domain still points where the marketing site implies it does.

Every provider publishes a pool number. Very few publish anything that lets you test it. The number itself is not the red flag. The red flag is a number with no method attached and no way to sample it.

Treat a pool claim as testable, not as a fact. Pull a few hundred exits during a trial and measure three things:

• Distinct IPs. How many unique addresses appear in 200 requests?
• Distinct /24 subnets. A hundred IPs inside one /24 is a single block of address space wearing a costume. Sites rate-limit and ban on subnets, so this is what your IP reputation actually depends on.
• Distinct ASNs. A network described as global that returns one autonomous system is one upstream supplier.

for i in $(seq 1 200); do
  curl -s -x "http://USER:PASS@gateway.sparkproxy.io:11000" https://api.ipify.org
  echo
done | sort -u | tee exits.txt | wc -l

# how many /24 blocks do those exits cover?
cut -d. -f1-3 exits.txt | sort -u | wc -l

Then map the addresses to their operators. Team Cymru's whois service answers ASN and network name for any IP:

whois -h whois.cymru.com " -v 203.0.113.10"

Run that against a sample of 20 exits. If a vendor sells "residential" IPs and every lookup returns a hosting or cloud ASN, they are selling datacenter IPs under a residential label, which is the most common product misrepresentation in this market. For the background on how address blocks are allocated and what registry data can prove, see BGP and RIR IP allocations and what a datacenter ASN is.

Honest trade-off: a low unique-IP count in a short test does not prove the pool is small. Rotating gateways often hold a session for a few requests, and some pools are geo-partitioned, so a country filter narrows your view to a slice of the network. Test with rotation forced on, across at least two countries, and only then judge.

Undisclosed resale shows up in infrastructure before it shows up in the product. Three checks find most of it.

Resolve the gateway. A vendor running its own edge points its gateway hostname at address space it controls. A reseller frequently points at the upstream's infrastructure, or at a thin forwarder sitting in front of it.

dig +short gateway.sparkproxy.io
whois -h whois.cymru.com " -v <the resolved IP>"

Compare exit sets. If you hold trials with two vendors, dump 200 exits from each and intersect them. Independent networks of any real size should overlap by close to nothing.

comm -12 <(sort -u vendorA.txt) <(sort -u vendorB.txt) | wc -l

A large overlap means one upstream and two brands. That is not automatically disqualifying, but it changes the negotiation completely. You are now comparing two prices for identical IPs, and the cheaper one wins unless the dearer one adds support you can name.

Read the docs for a slip. Resold dashboards often keep the upstream's parameter names, error strings, or session-ID syntax. If the API reference speaks one vendor's vocabulary while the marketing site speaks another's, you have found the supplier.

Proxy pricing has a floor set by real costs: address space, transit, and abuse handling. Offers below that floor are funded by something, and the something is usually you.

Two clarifications, because this test produces false alarms. Cheap datacenter proxies are legitimate. Datacenter address space genuinely is cheap to operate at scale, which is why unlimited-bandwidth datacenter plans exist at sane prices while unlimited-bandwidth residential plans almost never do. The question is not "is this cheap" but "is this cheap in a way the underlying product can support". Datacenter proxy pricing models explains which knobs the price is really attached to.

Second, free proxy lists are a separate category rather than a cheap version of this one. They are unmaintained, frequently hostile, and never worth production traffic. We covered why in free vs paid proxies.

Ask any vendor with an unlimited claim one question in writing: what is the throttle, and at what point does it apply? An operator with a real policy answers with numbers. SparkProxy publishes speed ceilings per plan in its Fair Usage Policy, from 25 Mbps on Starter up to 250 Mbps on Pro+, with custom plans up to 1 Gbps, and those are ceilings rather than guaranteed rates. A vendor that will not state a number either has no policy, or has one they would rather you discovered later.

This is the commercial layer, and it is where outright scams are easiest to catch.

Check domain age directly rather than trusting an "established 2015" badge in the footer:

whois sparkproxy.io | grep -i "creation date"
openssl s_client -connect www.sparkproxy.io:443 </dev/null 2>/dev/null | openssl x509 -noout -dates -issuer

A certificate issued last week on a domain registered last month, next to claims of a decade in business, ends the evaluation.

On refunds, read the exact wording before you buy. The clause that quietly voids most refunds is usage-based: "refunds available within 3 days provided no bandwidth has been consumed." That is not a refund policy, because testing the product is what consumes bandwidth. A usable policy states a window, a usage allowance inside that window, and an address to email.

Send these three before you pay. Anyone who operates the network can answer each in two sentences, and a reseller front end usually cannot answer any of them.

1. "Which ASNs do your US datacenter exits announce from?" An operator names them, or explains why the mix rotates. A reseller deflects to "our proprietary global network."
2. "What is the maximum sticky session duration, and what happens to in-flight requests when a session expires?" This is an implementation detail nobody can bluff. A vague answer means they do not control the rotation logic.
3. "Paste the exact response your gateway returns when I exceed my thread limit." A real operator gives you the status code and body. It also tells you whether your retry logic will classify it correctly instead of treating it as a target block.

Time the replies. The response speed you get as a prospect is the ceiling of what you get as a customer, not the floor. If a pre-sales question takes 48 hours, an outage at 2am will not be handled in 20 minutes.

Review manipulation in this market is heavy enough that raw star ratings are close to noise. Read the distribution instead of the average.

• Date clustering. Forty five-star reviews inside one week, then silence for months, is a campaign.
• Length and specificity. Real proxy reviews complain about something precise: a subnet that got banned on one target, a dashboard bug, a billing edge case. Purchased reviews praise "great speed and support."
• Reviewer history. Single-review accounts that have only ever reviewed this vendor tell you what you need to know.
• The cross-platform split. Vendors that farm one review site rarely farm two consistently, so a wide divergence between platforms is itself a signal.

Better sources: the vendor's own status page history, GitHub issues on their SDKs, and threads where a named engineer answers a specific technical complaint in public. A status page showing real past incidents is more trustworthy than an unbroken green wall, because the green wall usually means the page is decorative. Our guide to proxy uptime and reliability covers what those numbers should mean before you accept them.

Run this in order on any vendor before money changes hands. Steps 1 through 4 need no account at all.

1. Domain and infrastructure, 5 minutes. Run whois for creation date and registrant country, dig +short NS for nameservers, then resolve the gateway hostname and look up who operates that address space.
2. Entity and terms, 5 minutes. Find the legal name, the refund window, the acceptable use policy, and any published fair usage limits. If any of those four is missing, record it as a fail.
3. Support probe, 2 minutes to send. Email the three questions above, then carry on while you wait.
4. Claim arithmetic, 3 minutes. Compare the headline price against the product type. Flag every unlimited claim with no stated throttle.
5. Trial pull, 10 minutes. Take a trial or the smallest plan available. Pull 200 exits and count unique IPs, unique /24s and unique ASNs.
6. Target test, 5 minutes. Send 50 requests to the site you actually care about and record the status codes. A pool can be large, clean, and still useless on your specific target. Proxy testing methods has the full procedure if you want to formalize this into a repeatable script.

Two rules keep the whole exercise cheap. Buy the smallest plan for the first month even when the annual discount is tempting, and never migrate production traffic during the trial month. The switching cost you avoid is worth more than the discount you skip.

Weight the checks so one weak area cannot be argued away by a strong one.

Score honestly out of 100. Above 80 is a normal purchase. Between 60 and 80, buy the smallest plan and re-test in 30 days. Below 60, walk. For the deeper evaluation once a vendor clears this bar, see what to evaluate when selecting a proxy service.

The pattern to look for is simple: numbers specific enough to be wrong. A vendor willing to publish a limit is a vendor you can hold to it.

SparkProxy publishes the following, which is the level of detail worth demanding from anyone you evaluate:

All four are unlimited bandwidth with 30 days validity. Larger Pro and Pro+ tiers exist in the Fair Usage Policy at 1500 and 2000 threads, and those are quoted rather than listed, so if you need them, expect a conversation instead of a checkout button. The network is 1M+ datacenter IPs across 80+ countries including 50,000+ US addresses, reachable at gateway.sparkproxy.io on port 11000 for HTTP and HTTPS, 11002 for sticky sessions, and 13000 for SOCKS5. The Scraping API issues 1,000 credits with no card, so you can verify behavior on your own targets before deciding anything.

Two honest caveats, stated the way you should expect any vendor to state them. Speed figures are ceilings under fair usage, not guaranteed throughput on every request. And a datacenter pool, however clean, is the wrong tool for targets that block hosting ASNs outright, which is a product-fit question rather than a vendor-trust question. Knowing what a proxy pool is and which type your target tolerates saves more money than any negotiation will.