ProxyTorrent: Untangling the Free HTTP(S) Proxy Ecosystem

Free web proxies promise anonymity and censorship circumvention at no cost. Several websites publish lists with thousands of free proxies organized by country, anonymity level, and performance. However, these lists, populated via automated tools and crowd-sourcing, contain lots of unreachable, unreliable, and sometimes even malicious proxies. It is fair to say that little is known about the free proxy ecosystem. In this paper we shed light on this ecosystem via ProxyTorrent, a distributed measurement system that leverages both active and passive measurements. Active measurements discover free proxies, assess their performance and detect potential malicious activities. Passive measurements run at user premises (via a Chrome plugin) and collect statistics about proxy usage and performance in the wild. ProxyTorrent has been running since January 2017, monitoring up to 160,000 free proxies per day and totalling more than 1500 users. Our dataset shows that only half of the announced proxies have decent performance and that roughly 7% exhibit malicious behavior. Interestingly, malicious proxies are the ones that show the best performance, supporting the common belief that free proxies are “free for a reason”. Also, we observe users do not have strong anonymity preferences and select proxies in countries where they are most available.