Proxies for OSINT Investigations: Choosing a Provider

Investigation work is not one collection problem. It is four or five, each with a different correct purchase. Match the row, not the marketing.

For a mixed caseload the practical build is a cheap unlimited datacenter plan carrying 80 to 95 percent of request volume, with a smaller residential or mobile allocation held back for the sources that fight. Teams that buy one expensive tier for everything overpay by a large multiple and still get blocked on the hard sources, because IP type was never the thing failing.

A scraping proxy has one job: get the page. An OSINT proxy has three, and the extra two are what should drive your purchase.

The first is non-attribution. In commercial scraping, nobody minds if the target works out that a data company is crawling them. In an investigation, the exit IP is a disclosure surface. If a subject reads their server logs and sees repeat visits from an ASN registered to your agency, your law firm, or a government range, the collection has burned itself. Commodity VPNs are worse than useless here, since their ranges are widely published and pre-flagged.

The second is compartmentalization. Two unrelated cases sharing an exit IP creates a link between them that exists nowhere except inside your own infrastructure. If those cases ever meet in litigation or discovery, that shared IP is a fact someone can point at. Buy enough distinct concurrent sessions to bind an identity to a case rather than to a whole team.

The third is repeatability under scrutiny. Analytical products get challenged. You need to state what you fetched, when, from where, and what came back, then fetch it again months later. That favors providers with stable geo metadata and predictable session behavior over the cheapest pool with the highest churn.

Bulk threat-intelligence collection shares most of this infrastructure. If your program leans that way, the operational detail is in the guide on datacenter proxies for cybersecurity threat intelligence.

Vendor comparison pages lead with pool size. Pool size is the least useful number on the page. Weight these instead, and verify each one during a trial rather than taking the claim on faith.

Two deserve extra emphasis. Verify geo yourself. Providers inherit geolocation from registry data that can be months stale, and an IP labeled Germany that geolocates to Amsterdam in a commercial database hands you the wrong regional edition of a page without ever throwing an error. The result is a finding that looks clean and is wrong, the worst failure mode in analytical work. See what geo-targeting means in proxies before you commit.

And test on your real sources. A provider that scores well against a generic test endpoint tells you nothing about the specific registries, forums and platforms in your case files. Build a 30-URL list out of actual past cases and make that the trial benchmark.

The honest ranking for most investigations: start datacenter, escalate only the sources that measurably fail. For the underlying technical differences rather than the buying view, the residential vs datacenter proxies breakdown covers them.

One thing no proxy type fixes is your browser. IP rotation with an unchanged, unusual browser fingerprint links every session back together regardless of exit IP. If your workflow uses a real browser rather than an HTTP client, read what browser fingerprinting is and budget for profile isolation alongside the proxy spend.

There are two billing models in this market and they are not comparable line by line.

Per-GB metered is how most residential and mobile networks bill. Bright Data, Oxylabs, Decodo and IPRoyal each publish per-GB residential rates on their own pricing pages, stepping down with committed volume. Check each vendor's current page before you budget: as of September 2026 those list prices change often, and any figure quoted in a blog post ages badly. The structure matters more than the number. Under metered billing, an investigation that needs 400 image-heavy pages costs several times one that needs 400 text pages, and you cannot forecast that at case intake.

Flat thread-based billing is how datacenter plans usually work. You buy concurrency and a speed ceiling, bandwidth is not metered, and the bill is identical whether the case runs light or heavy. Where per-case volume is genuinely unpredictable, that predictability is worth real money.

SparkProxy's published datacenter plans, all unlimited bandwidth, 30 days validity:

Larger Pro and Pro+ tiers (1500 and 2000 threads, with 200 and 250 Mbps ceilings) exist under the Fair Usage Policy and are quoted rather than listed. Treat every speed figure as a ceiling, not a guaranteed rate: actual throughput depends on the target, the route, and how many threads you run at once.

How to size a plan. Size on peak concurrent requests, not monthly total. Two or three analysts doing interactive lookups plus one background collection job rarely exceed 100 concurrent connections, which is Starter territory. A team running continuous monitoring across hundreds of sources with rendering enabled sits in the 250 to 500 range. Sizing on monthly request count instead of concurrency is how buyers end up paying for four times the plan they need.

The network behind those plans spans over 1 million datacenter IPs across 80+ countries, including more than 50,000 US datacenter IPs, which is what makes per-country routing practical rather than theoretical for investigation work.

If you would rather not manage exits at all, the SparkProxy Scraping API bills in credits: 1,000 free credits with no card, then Starter at $49 for 250,000 credits a month with 50 concurrent requests, Growth at $99 for 1,000,000, Pro at $249 for 3,000,000, and Scale at $599 for 8,000,000. A plain fetch costs 1 credit, a JavaScript render 5, a screenshot or PDF 10. That last figure is directly relevant to evidence capture, covered below.

Send these in writing. How plainly a provider answers is itself a signal, and procurement or legal will ask you for the answers eventually.

1. What ASN and organization name do my requests exit under? Request a sample. Anything registered under a name implying "proxy" or "anonymizer" is a disclosure risk.
2. What connection metadata do you log, how long is it kept, and who can access it? Ask for retention in days.
3. Where is the company incorporated, and where do the logs physically live? This governs what can be compelled.
4. How are residential IPs sourced, and how is consent obtained? A vendor that cannot answer clearly is a compliance finding, not a technicality.
5. What is the replacement policy for a blocked or dead IP, and what is the response time?
6. Can I isolate credentials per case or per analyst? Sub-user credentials let you compartmentalize without running separate accounts.
7. Is there a trial or refund window long enough to run a real 30-URL test?
8. Do you require KYC or use-case approval, and what does that involve? Serious providers ask questions. That is a good sign, not an obstacle.

A broader checklist for evaluating any provider, including the technical tests worth running during a trial, is in what to evaluate when selecting a proxy service.

Once you have picked a provider the plumbing is short. SparkProxy routes through gateway.sparkproxy.io on three ports: 11000 for HTTP and HTTPS, 11002 for sticky sessions, 13000 for SOCKS5. Rotating exits come from 11000; when a task needs the same IP across several requests, use 11002.

# Rotating exit: confirm what a target would actually see
curl -x http://USER:PASS@gateway.sparkproxy.io:11000 \
     -s https://ipinfo.io/json

# Sticky session for a paginated source that must stay on one IP
curl -x http://USER-session-case4471:PASS@gateway.sparkproxy.io:11002 \
     -s https://ipinfo.io/json

Run that first command a dozen times before you touch a real target and record the ASN and org values that come back. That is your disclosure surface, and checking it takes two minutes. When to prefer sticky over rotating is covered in what a sticky session proxy is.

For rendered pages and evidence capture without maintaining a browser fleet, the Scraping API at https://scrape.sparkproxy.io/api/v1 takes an X-API-Key header and handles rotation, rendering and geo routing:

import requests

API = "https://scrape.sparkproxy.io/api/v1"
KEY = "YOUR_API_KEY"

def collect(url, country="US"):
    r = requests.get(
        API,
        headers={"X-API-Key": KEY},
        params={
            "url": url,
            "country_code": country,
            "render_js": "true",
            "format": "md",
        },
        timeout=90,
    )
    r.raise_for_status()
    return r.json()

Requesting format=md returns clean Markdown instead of raw HTML, which is far easier to diff across collection runs when you are tracking whether a page changed between two dates.

This is the part buyers forget until an analytical product gets challenged. Your proxy purchase should support it rather than fight it.

For every collection event, store the requested URL, the UTC timestamp, the exit IP and its reported country, the HTTP status, the response headers, a SHA-256 hash of the raw response body, and the raw body itself. Hash before any cleaning or parsing. Normalize first and you have hashed your pipeline's output rather than what the source served, which matters if anyone audits the collection.

Capture a screenshot or PDF for anything that may reach a report. Rendered evidence survives the source page being edited or deleted, and a non-technical reader can actually look at it. On the Scraping API that costs 10 credits per capture against 1 for a plain fetch, so capture selectively.

Keep case-scoped credentials. One sub-user per case, rotated at case close, records which collection belongs to which matter and stops two investigations sharing an identity by accident.

Good infrastructure does not change what you are allowed to collect.

In the United States, scraping publicly accessible data does not violate the Computer Fraud and Abuse Act. The Ninth Circuit held as much in hiQ Labs v. LinkedIn (2022), and Van Buren v. United States (2021) narrowed CFAA liability to circumventing genuine access controls. That is meaningful protection for OSINT built on public pages. It stops at the login prompt. Credential sharing, borrowed accounts and paywall bypass sit on the wrong side of both cases, and a rotating IP does nothing to move them back.

Personal data carries its own regime. GDPR applies to processing personal data about people in the EU regardless of where your team sits, and open-source collection is processing like any other. Investigations often have a legitimate-interest basis, but "often" is not "always", and the assessment has to be documented before collection rather than after. Platform terms of service are a separate contractual matter: breaching them is generally not a crime, but it can end an account and it will be raised.

Rules that hold up in practice: collect only what the matter requires, honor access controls, keep a retention schedule, pace requests so you are not degrading a small site's service, and involve counsel for anything cross-border or at scale. Collection etiquette is covered in the ethical scraping and rate limiting guide. None of this is legal advice.

Four things a vendor is unlikely to volunteer.

Datacenter proxies will fail on consumer social platforms. No amount of rotation fixes an ASN check. If your caseload leans social, budget for residential or mobile from day one rather than discovering it in week three. Platform-specific collection patterns are in the notes on social media monitoring with proxies.

Unlimited bandwidth is not unlimited speed. Flat plans carry a speed ceiling and a fair usage policy. For investigation workloads, which are bursty and comparatively light, that ceiling almost never binds. For continuous multi-terabyte crawling it will, and you should be honest about which one you are.

Pool size is a vanity number. A million IPs concentrated in three subnets serves you worse than a hundred thousand spread widely. Ask about subnet diversity in your target countries, which is a real question, instead of the headline total.

Sometimes the answer is not to buy proxies at all. If the entire need is occasional manual lookups by two analysts, a well-managed set of isolated browser profiles on a couple of clean egress paths may be enough. Proxy infrastructure earns its cost when collection is automated, geo-distributed, or high volume. If it is none of those, spend the budget on tooling.