Using Geonode Proxies for Cybersecurity and Threat Research

Why security researchers need proxies

Attackers don't want to be found. Phishing kits, malicious ad campaigns, fraud sites and malware distribution pages increasingly use cloaking: they show harmless content, or nothing at all, to visitors who look like security researchers, while serving the real payload to targets. Common filters include blocking known corporate, security vendor and datacenter IP ranges; only serving content to visitors from certain countries or ISPs; and checking the referrer, device and browser.

Investigating from your company network or a cloud server often shows nothing. Proxies let analysts look like ordinary users in the targeted locations. Geonode residential proxies with country, state, city and ASN targeting provide that consumer view, and its datacenter traffic gives a contrasting view that helps reveal cloaking.

Common security uses

Investigating safely

Malicious pages can exploit browser vulnerabilities or trick analysts. Precautions:

• Isolate: use a dedicated virtual machine or a disposable browser environment, never your daily browser.
• No real accounts: don't be logged in to anything.
• Keep software updated: the browser and OS in your analysis environment.
• Don't enter real credentials, even to "see what happens".
• Separate infrastructure: run investigations from systems not connected to production networks.
• Use sticky sessions so a chain of requests comes from one consistent identity.

Revealing cloaking

1. Load the URL from a datacenter exit and record what you see.
2. Load it from residential exits in the country and ISP the campaign targets.
3. Repeat with a mobile device profile and with a plausible referrer (for example, from a search result or email link where appropriate).
4. Compare content, redirects and network requests between the views.

Differences between views are strong evidence of cloaking and help explain why automated scanners miss a threat.

Evidence for takedowns

Capture screenshots, page HTML, network logs and redirect chains, with timestamps and exit locations. Hosting providers, registrars and browser safe-browsing programmes act faster on clear evidence. Store evidence securely, since it may contain malicious code.

Testing your own defences

Security teams also use proxies to check their own systems: that geo-blocking rules work, that fraud and bot rules don't block legitimate users in key markets, and that login and payment flows behave correctly in each region. Use exits in allowed and disallowed regions and document results.

Responsible use

Use proxies for defensive research and testing of systems you own or are authorised to test. Don't use them for unauthorised access, credential testing against third-party services, or anything that harms the people whose residential connections carry your traffic. Choose a provider with clear sourcing; Geonode states that its residential IPs come from opt-in partners. See ethically sourced proxies.

Costs

Investigations are bursty and browser-heavy. Geonode's residential bandwidth doesn't expire, which suits incident-driven work, and datacenter traffic covers bulk threat intelligence collection cheaply.

Building a repeatable investigation kit

Teams that investigate suspicious sites regularly benefit from a standard kit:

• A disposable analysis environment, rebuilt from a clean image for each case or each day.
• Browser profiles per persona: desktop and mobile, different languages, no history.
• Proxy presets: residential exits for the countries most often targeted in your cases, plus a datacenter preset for comparison.
• Capture tooling: full-page screenshots, HTML saves, network logs (HAR files) and redirect chain recording.
• A case template: URL, reporter, timestamps, views captured (with exit location), findings, reports filed, outcomes.

With Geonode presets ready, an analyst can view a reported URL from three countries and a datacenter in minutes, which is often enough to confirm cloaking and gather evidence before the site disappears.

Sharing findings

Indicators from investigations (domains, URLs, hosting details, kit fingerprints) are valuable to others. Share them through your organisation's threat intelligence processes and trusted industry channels, and report malicious sites to safe-browsing services so browsers warn users. For the brand impersonation side of this work, see Geonode for brand protection.

Starting small

Set up one isolated analysis environment with three Geonode presets (two residential countries and one datacenter view) and use it for every reported URL for a month. You'll quickly see how often cloaking hides what victims see.

To compare Geonode with other providers for security research, see our guide to the best proxies in 2026.

For a Webshare-specific walkthrough, see Webshare Proxies for Cybersecurity Research, which explains the right product, settings and costs for this job.

Considering Rayobyte instead of, or alongside, Geonode for this? Rayobyte vs Geonode compares the two, and How Rayobyte Sources Its Residential IPs, and Why It Matters covers the Rayobyte setup.

FAQ

Why does a phishing site look harmless when I check it?

It may be cloaking: filtering out security, corporate and datacenter IPs, or visitors outside its target region.

Is it safe to visit malicious sites through a proxy?

The proxy hides your network, but it doesn't protect your device. Use isolated environments.

Residential or datacenter for security research?

Both. Residential shows what targets see; datacenter gives a contrasting view that reveals cloaking.

Can I use proxies for penetration testing?

Only within an authorised scope. Proxies don't change the need for permission.

Sources and further reading

Independent references that back up the points above, from standards bodies, governments, universities and non-profits. They open in a new tab.

• Public Service Announcement on residential proxy botnets (FBI IC3): The FBI's warning about residential proxy networks built from compromised computers.
• Internet service provider (Wikipedia): What an ISP is, the companies whose address space ISP and residential proxies use.
• Bandwidth (computing) (Wikipedia): What bandwidth means, the unit most residential proxies are priced by.
• Forum of Incident Response and Security Teams (FIRST): The global association of incident response teams.
• Software Engineering Institute (Carnegie Mellon University): Carnegie Mellon's federally funded security research centre.