Port scanning
Probing an address across many ports to find services that answer, which is how most public proxy lists are assembled in the first place.
Port scanning sends a connection attempt to a range of ports on an address and records which ones respond. For proxy lists specifically, a scanner looks for ports that answer like a proxy, confirms one forwards a test request, and publishes the address-and-port pair. It is the mechanical origin of nearly every free proxy you will find.
This is why one address can appear on a list dozens or thousands of times over, once per open port, and why the ports themselves cluster: scanners check the conventional proxy ports first, so those fill up fastest. It is also why so many published entries never actually work. A port can look open to a fast scan and still refuse a real proxy handshake, and lists that never test past the scan republish that noise.
The defensive side of the same technique matters too. Site operators and hosts scan their own ranges to find exactly these exposed services before someone else does, since an open proxy on your network is both a liability and an invitation.
The gap between open and working is the part that explains why free lists disappoint. A TCP handshake completing tells you a process is listening and nothing more. It does not tell you the service speaks a proxy protocol, that it will relay to an arbitrary destination, that it is not requiring authentication, or that it will still be there in an hour. A list built from port probes alone republishes all of that uncertainty as if it were supply.
That is also why the same address turns up repeatedly across lists with different ports attached. Each address-and-port pair is a separate finding, so one misconfigured host can generate many entries, and a scanner that checked the conventional proxy ports first produces the clustering you see around 3128, 8080 and 1080.
One caution worth stating plainly: scanning networks you do not own is treated very differently in different jurisdictions, and can breach a provider's acceptable use policy regardless of legality. Scanning your own infrastructure to find what you have accidentally exposed is straightforward and sensible. Scanning other people's is not something to do casually.
How HProxy handles it
We record every address-and-port pair separately and run a real proxy handshake against each, not just a port probe, which is why our per-port pages can tell you how many of the addresses on a given port have ever genuinely answered rather than merely looked open.
Frequently asked questions
Why do free proxy lists have so many dead entries?
Because most are assembled from port scans without a real proxy handshake afterwards. An open port means a process is listening; it does not mean the service speaks a proxy protocol, will relay to your destination, or will still exist in an hour. Lists that publish scan results without verifying them are republishing uncertainty as supply.
Is port scanning legal?
It varies by jurisdiction and it is genuinely contested, and it can breach a hosting provider's acceptable use policy even where it is not unlawful. Scanning infrastructure you own or administer to find accidental exposure is uncontroversial. Scanning networks belonging to other people is not something to do without understanding the rules where you are.
Why does the same IP appear many times on a proxy list?
Because each address-and-port pair is a separate finding. One misconfigured host with several listening ports produces several entries, and scanners check the conventional proxy ports first, which is why entries cluster around 3128, 8080 and 1080 rather than being spread evenly.
Can a site detect that I am scanning it?
Readily, because a scan has an unmistakable shape: many connection attempts across a range of ports or addresses in a short window, from one source, most of them to services that are not there. Firewalls and intrusion-detection systems are tuned for exactly that pattern and will often block the source after the first burst. It is one more reason scanning is something you do to infrastructure you own, not to networks belonging to other people.
Back to the full glossary.