Loading page content.
Loading page content.
Security research
Threat infrastructure behaves differently depending on who is looking. Attributable, dedicated exits let a research team observe it without exposing the organisation's own ranges or contaminating a shared pool.
The problem
Investigating a phishing kit, a malware distribution host or a credential-harvesting page from the organisation's own address does two things at once: it tells the operator that this organisation is looking, and it puts the organisation's range into whatever blocklist the operator maintains. Both are avoidable, and both are difficult to undo.
The infrastructure being studied is also actively evasive. Phishing kits routinely cloak: the page renders the lure for visitors that look like targets and a benign decoy for everything that looks like a scanner, a sandbox or a security vendor. The signals used are the visitor's ASN, geography, user agent and referrer, and hosting ranges belonging to known vendors are the first thing filtered.
Geography matters as much as network type. Regional campaigns commonly serve the payload only to addresses in the targeted country and a redirect to a legitimate site for everyone else, so a research vantage point outside the campaign's geography sees nothing and reports the URL as clean.
Why proxies
Security research inverts the usual proxy requirement. The goal is not to be many visitors; it is to be one controlled, isolated, documented visitor whose network identity is known to the team and to nobody else. A dedicated IPv4 lease provides exactly that: an address held by one customer, with a stable ASN and a stable geography, that can be recorded in the case file and rotated deliberately when it burns.
Isolation is the second requirement. On a shared pool, another tenant's activity affects the reputation of the address you are observing from, and a reputation change mid-investigation is a variable nobody wants in a case file. A dedicated lease removes that variable entirely.
Recommended product
Dedicated IPv4 on Tier-1 backbones, 10 Gbps and unmetered
from $2.65/GB
Observing a cloaked lure as an intended victim sees it requires a consumer ISP address in the targeted country; a hosting address will be served the decoy.
from $2.50/IP/wk
Tooling that speaks SOCKS5 or needs UDP — DNS research, some scanners, tunnelled clients — is better served by a SOCKS5 lease than by an HTTP gateway.
Worked example
Research fetches need to be recorded as carefully as they are made. Everything that identifies the vantage point goes into the record alongside the response, so a later reviewer can say exactly what was observed and from where.
import hashlib
import json
from datetime import datetime, timezone
import requests
# A dedicated lease: one address, one tenant, recorded in the case file.
EXIT_IP = "198.51.100.24"
PROXY = f"http://fp_research:Xk7mQ2pTz9vRn4Ls@{EXIT_IP}:8080"
PROXIES = {"http": PROXY, "https": PROXY}
def observe(url: str, note: str) -> dict:
response = requests.get(
url,
proxies=PROXIES,
timeout=(10, 30),
allow_redirects=False, # The redirect chain is the observation.
headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"},
)
return {
"url": url,
"observed_at": datetime.now(timezone.utc).isoformat(),
"exit_ip": EXIT_IP,
"status": response.status_code,
"location": response.headers.get("Location"),
"server": response.headers.get("Server"),
"body_sha256": hashlib.sha256(response.content).hexdigest(),
"bytes": len(response.content),
"note": note,
}
record = observe("https://suspicious.example/login", note="reported by SOC ticket 4821")
print(json.dumps(record, indent=2))Replace the credential with the one in your dashboard. The gateway host, port and username format are the same across every product.
Pitfalls
Each of these is common, cheap to fix, and expensive to leave in place. They are listed in roughly the order teams hit them.
It discloses the organisation's interest and adds its ranges to an operator's blocklist, both permanently. Route every outbound investigative request through a dedicated research exit, and treat any exception as an incident rather than a shortcut.
Cloaking filters hosting ASNs first. A datacenter exit is the right tool for attribution and isolation, and the wrong tool for seeing what a victim sees. When the question is 'what did the target receive', the observation needs a consumer exit in the targeted country.
Active scanning, probing or testing of infrastructure you do not own or have written permission to test is prohibited by our acceptable-use policy and, in most jurisdictions, by law. This product is for observation and research within those boundaries, and abuse reports are acted on.
An observation without its exit address, timestamp and geography cannot be reproduced or challenged. Record them automatically at the point of the request; a note written afterwards is a note about what somebody remembers.
Questions
Start on 50MB of free residential bandwidth, measure your own targets, and scale into volume tiers that step the rate down as the job grows. Unused bandwidth never expires.
No card required for the trial. Cancel or downgrade at any time.