KovraSearch "free proxy list" and you get thousands of IP and port pairs, updated hourly, sorted by country and uptime. The infrastructure behind those tables is real: someone is paying for bandwidth, someone is scanning the internet to find them, someone is keeping the list fresh. The useful question is not whether free proxies work. It is who benefits when you use one.
Where the entries on those lists come from
1. Misconfigured servers
Open proxies exposed by accident — a default Squid install, a forgotten test container, a router with UPnP doing something unintended. They appear in lists within hours of being scanned, work erratically, and vanish when someone notices the bandwidth bill. Using them is unauthorized use of someone else's machine.
2. Deliberate collection points
Proxies run specifically to see what passes through. This is cheap: a small VPS costs a few dollars a month and can sit on dozens of lists. The operator gets a stream of requests to inspect, replay or modify.
3. Compromised machines
Residential devices infected with malware and rented out as exit nodes. Your traffic goes out through a stranger's home connection — which is also why some "free residential proxies" look impressively legitimate to websites.
What the operator can actually do
| Attack | Possible? | Notes |
|---|---|---|
| Log every domain you visit | Always | Connection metadata is unavoidable — that is the job |
| Read plain HTTP content | Always | Forms, cookies, tokens on non-HTTPS pages |
| Inject ads or scripts | On HTTP pages | Documented in the wild for years |
| Read HTTPS content | No, not silently | Requires you to accept a bad certificate |
| Trigger downgrade to HTTP | Sometimes | Blocked by HSTS on well-configured sites |
| Attribute your traffic to you | Always | Your real IP is the connecting address |
| Get you blocked | Frequently | Shared IPs are already on abuse blocklists |
Note the asymmetry in that last row: you are anonymous to the website, and completely identified to the proxy. That trade is only sensible when you trust the operator more than the destination — precisely the opposite of the situation with an anonymous list entry.
The practical problems, before the security ones
- They are already blocklisted. Public proxy IPs are on every commercial abuse feed, so Cloudflare challenges, login blocks and CAPTCHA walls follow you around.
- Uptime is fiction.The "98%" in the list was measured against the list's own checker, not against real sites.
- Bandwidth is shared with whoever else found it.
- No encryption means your network operator sees the same hostnames it always did — the proxy hides you from the site, not from the network. That distinction is the whole of the VPN versus proxy question.
If you must use one
- Only for content that is already public and not sensitive.
- Never while logged into anything. One session cookie is worth more than a year of any subscription.
- Use a separate browser profile so cookies and history stay isolated.
- Never accept a certificate warning. That prompt is the attack.
- Verify afterwards that DNS did not leak around it — the checks are in the leak test guide.
The alternatives, by budget
Free but accountable:Tor for anonymity where speed does not matter, or a browser's built-in private relay for casual IP masking. Both have named operators and published designs.
Paid proxy: if you genuinely need rotating exits for automation, a commercial provider with a contract and an abuse desk. The technical trade-offs are in SOCKS5 versus VPN.
Paid VPN: for privacy rather than IP rotation, this is the category that fits. A private no-logs service starts around three dollars a month — see what that money actually buys — and can be paid in crypto with no email at signup, so "paid" does not have to mean "identified".
The rule
A proxy sees everything you route through it. Choosing a free one from a public list means picking an anonymous stranger to see it — selected, in effect, at random. The reason paid services can be held to a no-logs standard is that there is someone to hold; the method for checking is in how to verify no-logs claims.