Fake Proxies on Cloudflare IPs: How to Spot Them
By the Proxy11 team. Updated .
Free proxy lists often include addresses that are not proxies at all. Cloudflare servers are the most common case, and they can pass a simple proxy test.
How a web server passes a proxy test
A basic checker asks an address to fetch a test page and looks for the expected text in the reply. If that page sits behind Cloudflare, any Cloudflare server will happily serve it, because it sees a hostname it looks after. The right text comes back, so the address looks like a working proxy.
No proxying happened. Try to reach any other site through that address and it fails.
Turning Cloudflare off for a subdomain doesn't always help either. Cloudflare servers can still answer for a name on a domain that uses their network.
Signs of a fake
- The address is in the IP ranges Cloudflare publishes at cloudflare.com/ips.
- The response through the proxy has a cf-ray header, even though your test host is not behind Cloudflare.
- It works with your test page but can't reach an unrelated site.
- A list has an unusually large share of port 80 addresses.
How to check an address
Look at the response headers through the proxy. Use a test URL you run yourself, on a host that is not behind Cloudflare:
curl -s -o /dev/null -D - -x 203.0.113.10:80 http://your-test-host.example/ | grep -i cf-ray
If that prints a line, the address is suspect. Then fetch a second, unrelated site through it. A real proxy can reach both.
Build it into your checker
- Drop addresses in Cloudflare's published ranges before testing. Some fakes sit outside those ranges, so don't stop there.
- Reject any response with a cf-ray header.
- Never test only against a page behind the same CDN as the addresses you're testing.
- Treat a very high pass rate on a public list as a warning sign.
Our free proxy checker already applies these checks, so you can paste a list in to try it.