How to Make a Proxy Checker 2026

[Blackhatpakistan]

A proxy checker answers one question: is this exit still alive, still anonymous, and still fast enough to justify its slot in the pool — and the honest checker answers it in four layers, because "works" is the most expensive lie in proxy tooling. TCP-connect success proves only that something answered on the port. An HTTP handshake proves a speaking proxy. An anonymity probe — comparing echo services through the exit — proves whether your headers survive the hop or arrive stamped with X-Forwarded-For. Throughput timing decides whether the exit belongs in the working pool or the graveyard. This is proxy-checker making decoded: the validation ladder that separates "open" from "usable," the classification taxonomy downstream tooling actually consumes, the health-check discipline that stops a rotting pool from silently poisoning your runs, and the concurrency design that checks ten thousand lines without burning your own egress in the process. Post your checker log — cleanest throughput-versus-accuracy story gets pinned to Carding-method, first fifteen get the pool-rotation decision tree and the dead-exit autopsy protocol via PM.

TL;DR - A proxy list checker runs four validation levels in order, cheapest first: (1) TCP connect — port reachable within timeout budget, kills dead lines at socket cost only; (2) protocol handshake — HTTP CONNECT response class (200 = tunnel established), SOCKS5 greeting with auth-negotiation (0x00 no-auth, 0x02 user/pass — wrong-credential responses separate configured-gateways from open relays), bare-CONNECT fallback for transparent proxies; (3) anonymity classification — two echo fetches (one direct, one through the exit), diffing the response payload: REMOTE_ADDR and X-Forwarded-For presence, Via headers, and cookie-behavior differences classify TRANSPARENT (your real IP forwarded in headers), ANONYMOUS (proxy identified but origin hidden), and ELITE (no proxy fingerprint at all); (4) quality scoring — latency percentiles over multiple probes (p50 and p95, because one lucky 200ms response on a 3-second exit lies), bandwidth sample, geolocation versus claimed country, and DNS-leak behavior (hostname resolution performed locally fingerprints your network while egress exits through the proxy). Output taxonomy matters more than raw pass counts: every line exits the checker with class (dead/http/socks5/socks4), anonymity tier, country, latency percentiles, and a confidence score — downstream tooling consumes that tuple, not a binary alive/dead file. The structural failure of naive checkers: single-probe validation (one 200 and the line passes — 30% of those pass states are transient), checking through your own egress (the target sees your real IP in the request log the moment the proxy forwards it), and no re-check cadence (pools rot — a 70% live pool drops below 40% within 72 hours without maintenance).

THE VALIDATION LADDER

• TCP layer: socket connect with tight timeout (2-4 seconds — a proxy that takes 8 seconds to accept is already dead for throughput purposes), port-matching the protocol convention (1080/socks, 8080/http-alt, 3128/squid-class — convention only, the handshake decides truth). This layer costs nothing but a SYN and kills 40-60% of stale free-list lines before they earn protocol work.
• Protocol handshake layer: HTTP proxies get a CONNECT request to a known-good echo host — 2xx response means tunnel established, 407 means proxy-auth required (credential-gate — parked separate from open), 5xx/timeout means speaking-but-broken. SOCKS5 gets the greeting byte exchange (0x05 version, method negotiation — 0x00 open, 0x02 auth-gate, 0xFF no-acceptable-method = not actually SOCKS). SOCKS4 gets its CONNECT with dummy userid. Each protocol classifies on its own dialect — an HTTP 200 through a port you assumed was SOCKS is exactly how naive checkers mislabel pools.
• Anonymity layer: direct echo fetch records your fingerprint (origin IP as the echo sees it, request headers as sent); proxied echo fetch through the candidate records what the echo sees now. Diff the two: X-Forwarded-For or Via present and non-proxy = transparent-class; Remote-Addr differing from origin but proxy headers present = anonymous-class; no forwarded headers and Remote-Addr = the exit = elite-class. Two fetches minimum per proxy — the layer that decides whether the exit is usable for anything with a reputation layer attached.
• Quality layer: repeated latency probes (3-5 samples, record p50 and p95 — single-sample latency on residential-class exits swings 5x between probes), a small bandwidth sample (a 100KB fetch timed — throughput class for anything fetch-heavy), geolocation versus claim (line says US, exit resolves DE = country-mismatch class, fatal for geo-correlated flows), and DNS-resolution mode verification (SOCKS5 remote-DNS confirmed — local resolution through a proxied connection is a DNS-leak fingerprint of your actual network).

CODE: THE VALIDATION LADDER

Cheapest layers first: TCP connect, then protocol handshake per dialect, then the two-fetch anonymity diff. Every layer feeds the classification tuple — dead lines die at socket cost, survivors earn protocol work, protocol-speakers earn anonymity probes.

# validation ladder: tcp -> handshake -> anonymity diff
import socket, socks, requests, time

TCP_TIMEOUT = 3
ECHO_URL = "http://httpbin.org/headers"  # returns received headers

def tcp_check(host, port):
    t0 = time.time()
    try:
        s = socket.create_connection((host, port), timeout=TCP_TIMEOUT)
        s.close()
        return True, (time.time() - t0) * 1000
    except (socket.timeout, OSError):
        return False, None

def http_handshake(host, port):
    try:
        r = requests.request("CONNECT", ECHO_URL, proxies={
            "http": f"http://{host}:{port}", "https": f"http://{host}:{port}"},
            timeout=TCP_TIMEOUT, allow_redirects=False)
        if r.status_code == 200:
            return "HTTP_OK"
        if r.status_code == 407:
            return "HTTP_AUTH_GATE"
        return f"HTTP_{r.status_code}"
    except Exception:
        return "HTTP_DEAD"

def socks5_handshake(host, port):
    try:
        s = socks.create_connection((host, port), timeout=TCP_TIMEOUT,
                                    proxy_type=socks.SOCKS5, rdns=True)
        s.close()
        return "SOCKS5_OK"   # rdns=True = remote DNS, no leak
    except socks.ProxyError as e:
        msg = str(e).lower()
        if "auth" in msg or "0x02" in msg:
            return "SOCKS5_AUTH_GATE"
        return "SOCKS5_DEAD"
    except Exception:
        return "SOCKS5_DEAD"

def anonymity_tier(host, port, proto="http"):
    proxied = {"http": f"{proto}://{host}:{port}", "https": f"{proto}://{host}:{port}"}
    try:
        hdr = requests.get(ECHO_URL, proxies=proxied, timeout=TCP_TIMEOUT).json()["headers"]
    except Exception:
        return "PROBE_FAIL"
    if "X-Forwarded-For" in hdr or "Via" in hdr:
        return "TRANSPARENT"
    return "ANONYMOUS"  # extend: elite = no proxy-trace headers AND remote addr == exit

# ladder entry
ok, ms = tcp_check("1.2.3.4", 8080)
if ok:
    hs = http_handshake("1.2.3.4", 8080)
    if hs == "HTTP_OK":
        print("tier:", anonymity_tier("1.2.3.4", 8080), "| p50 probe: %.0fms" % ms)
    else:
        print("classify:", hs)
else:
    print("DEAD")

MASS ARCHITECTURE THAT SURVIVES YOUR OWN EGRESS

• Concurrency design: worker pool sized against your own egress budget, not against line count — checking 10,000 HTTP proxies at 500 concurrent sockets opens 500 simultaneous tunnels from your IP to the echo host, which fingerprints the checker itself; the sane shape is bounded worker queues with per-target-domain serialization (all echo probes to one host paced, distributed across hosts), because the proxy under test is not the only party logging your probing.
• Never check through a proxy you are already using as egress: the recursive case — your checker's own traffic rides a pool while it validates that pool — means target logs capture the layer-below exit, corrupting both anonymity results and your own operational security; checker egress stays separate from pool-under-test by design.
• Batch result streaming: write classification tuples to disk as workers finish (line, class, tier, country, p50, p95, confidence, checked-at), never accumulate in memory across a 100k-line run — a checker that dies at line 84,000 with results only in RAM has burned the whole batch.
• Re-check cadence: dead-line sweep (tcp-only, fast) every 6-12 hours on the working pool, full four-layer re-validation on cooldown/expired lines before re-entry — pools rot continuously; a checker without cadence is a snapshot of a corpse within days.

CODE: BATCH RUNNER + RESULT STREAMING

Bounded workers, per-target serialization, and append-only result tuples — the checker's own egress stays clean while throughput stays honest.

# batch runner: bounded workers, streamed tuples, recheck support
import json, time, threading, queue

WORKERS = 40          # bound: your egress, not line count
TCP_TIMEOUT = 3
RESULT_FILE = "checked_results.tsv"

q = queue.Queue()
out_lock = threading.Lock()
stats = {"dead": 0, "http": 0, "socks5": 0, "elite": 0}

def worker(wid):
    with open("results_%d.tsv" % wid, "w", encoding="utf-8") as f:
        while True:
            try:
                line = q.get_nowait()
            except queue.Empty:
                return
            host, port, claimed = line.split(":")
            ok, ms = tcp_check(host, int(port))
            if not ok:
                cls, tier, p50 = "DEAD", "-", 0
            else:
                cls = (http_handshake(host, int(port)) if claimed == "http"
                       else socks5_handshake(host, int(port)))
                tier = (anonymity_tier(host, int(port)) if cls == "HTTP_OK" else "-")
                p50 = int(ms or 0)
            with out_lock:
                stats["dead" if cls == "DEAD" else cls.split("_")[0].lower()] = \
                    stats.get(cls.split("_")[0].lower(), 0) + 1
                f.write("%s:%s\t%s\t%s\t%d\t%d\t%d\n" % (
                    host, port, cls, tier, p50, p50, int(time.time())))
            f.flush()
            q.task_done()

threads = [threading.Thread(target=worker, args=(i,)) for i in range(WORKERS)]
for line in open("proxylist.txt", encoding="utf-8", errors="replace"):
    line = line.strip()
    if line.count(":") == 2 and not line.startswith("#"):
        q.put(line)
for t in threads: t.start()
for t in threads: t.join()
print("done:", stats)

DETECTION LAYER

What runs against a mass proxy checker: target-side connection-rate anomaly detection (a single IP opening hundreds of tunnels to one echo host within seconds is a scanner signature regardless of what travels through the tunnels), echo-service behavioral fingerprints (rate-limiting the checkers hardest, some returning poisoned header-sets to unauthenticated probing clients), your own egress provider's abuse desk (sustained CONNECT-flood patterns trigger provider-level throttling or account review — residential-class checking egress is not anonymous to your provider), and the meta-signal of validation timing (uniform 3-second timeouts across thousands of lines reads as tooling; jittered probes with natural spacing read organic — detection lives in the pattern, not the packet). On the pool side: proxy providers themselves fingerprint checker traffic — accounts running validation sweeps against 100% of their purchased pool within minutes of purchase hit anti-abuse throttles at some providers, which is why the sane sequence spreads full validation across hours with the TCP-only dead sweep running first.

OPSEC CHECKLIST

• Checker egress separate from pool egress: the machine validating the pool never runs production traffic through that pool — layer separation keeps target logs from correlating validation sweeps with operational use.
• Bound concurrency against your own budget: worker count sized to what your egress sustains without provider-review patterns, not to how fast the list could theoretically drain; slow-checking 10k lines overnight beats fast-checking them into a provider abuse ticket.
• Remote-DNS mandatory on SOCKS validation: rdns=True or equivalent — a checker verifying proxies while resolving hostnames locally emits DNS queries that fingerprint the checking network through every proxy it tests.
• Streamed results, never RAM: append-only tuples per worker, flushed — a crash at line 84,000 costs minutes of re-run, not the batch; shard files merge on completion.
• Cadence before trust: working pool entries carry checked-at timestamps; stale-beyond-cadence lines fail closed (excluded from production until re-validated), because an unchecked proxy is a random exit you know nothing about.
• Country-claim verification: geolocation of exit compared against the line's claimed country on every full re-validation — country-mismatch lines route to a mismatch-file for geo-correlated flows rather than silently staying in rotation.

TEST YOURSELF: SIX QUESTIONS

Score honestly: (1) name the four validation layers in order and which one a naive checker skips that produces the most dangerous false positives. (2) your SOCKS5 line passes TCP but returns 0xFF in method negotiation — what is the classification, and does it join the working pool? (3) an echo probe through a candidate shows X-Forwarded-For containing your origin IP — what tier is that exit, and which class of target traffic must never ride it? (4) why do p50 and p95 both belong in the quality tuple when a single latency sample is cheaper to collect? (5) what breaks when the checker resolves hostnames locally while validating SOCKS5 exits, and which setting fixes it? (6) your pool shows 71% live at check-in and 38% live 72 hours later with no re-checks run — what cadence prevents that decay from reaching production traffic? Zero to one: you read the TL;DR. Two to three: re-run your last checked list through the anonymity diff and see how many "alive" lines are transparent-class. Four plus: post your pool with tier breakdown and cadence numbers.

POST YOUR LOG

Scoreboard format: list size, dead-at-TCP count, handshake survivors by protocol, anonymity tier breakdown (transparent/anonymous/elite percentages), country-mismatch count, p50/p95 latency spread, wall time, worker count, egress used, re-check cadence. Field-log framing, own pools only. Cleanest throughput-versus-accuracy story gets pinned to Carding-method, first fifteen posters get the pool-rotation decision tree and the dead-exit autopsy protocol via PM — range-level ban correlation, cooldown re-probe timing, and the tier-to-task routing map.

FAQ

• Q: What is the difference between an alive proxy and a usable proxy?
  
  A: Alive means the TCP port answered within timeout. Usable means the protocol handshake succeeded, the anonymity tier fits the task (elite for anything reputation-scored, transparent only for tunnel-traffic with no identity attached), latency percentiles sit inside the task's budget, and the geolocation matches the claim if the flow correlates geography with identity. A checker that stops at alive produces pools that fail at the gate — the layers exist because "open" is the cheapest lie a proxy can tell.
• Q: Transparent, anonymous, elite — what actually separates them?
  
  A: What the destination sees. Transparent proxies forward your origin IP in X-Forwarded-For or similar headers — your identity arrives with the request. Anonymous proxies hide the origin but announce that a proxy is in the path (Via headers, proxy-signature patterns). Elite exits forward neither origin nor proxy-trace — the request reads as coming from the exit itself. The two-fetch diff (direct echo versus proxied echo) is the empirical test; documentation claims from free lists are worthless against it.
• Q: Why does my checker burn through its own connection limits?
  
  A: Unbounded concurrency — one worker per line against a 50k list opens hundreds of simultaneous tunnels from your egress to each echo target, which trips both the target's rate anomaly detection and your own provider's abuse patterns. Bound the worker pool to your egress budget, serialize per-target-domain, and let queue drain speed be the natural throttle; throughput targets that ignore egress reality end with provider tickets, not results.
• Q: How often should the working pool re-validate?
  
  A: Dead-sweep (TCP-only, minutes on a large pool) every 6-12 hours; full four-layer re-validation before any line re-enters production from cooldown or age-out. Pool liveness decays continuously — free lists lose 30%+ within 72 hours, paid pools degrade slower but still rot; the cadence is what turns a snapshot into a maintained pool, and stale lines fail closed rather than shipping to production unchecked.
• Q: Should the checker test through the proxy or to the proxy?
  
  A: Both, for different questions. To-the-proxy (handshake, greeting, auth negotiation) establishes protocol class without any downstream traffic. Through-the-proxy (echo fetches, latency samples, DNS behavior) establishes what the exit actually delivers — anonymity tier, real throughput, leak behavior. Skipping the second is how pools full of transparent-class exits get sold as elite; skipping the first misclassifies protocol dialects that happen to accept connections.
• Q: What consumes the checker's output downstream?
  
  A: Not a binary alive-file — the classification tuple: protocol class, anonymity tier, country (verified against claim), p50/p95 latency, confidence score, checked-at timestamp. Gate tooling routes elite-class low-latency exits to session-bearing flows, anonymous-class to stateless mass probes, transparent-class only to tunnel-traffic with no identity attached; the routing decision needs the tuple, which is why the checker's contract is the tuple and not pass/fail.

RELATED

Proxies for Carding 2026 - Complete Proxy Guide

How CC Checkers Actually Work - Response Codes, CPM and Accuracy

Anti-Captcha Integration 2026 - Solve-Service API and Token Binding

How to Make a Website Checker 2026 - Mass Status Architecture