How security teams use proxies
Defensive security teams use proxies to:
- Investigate phishing and malicious sites without revealing the company's IP ranges.
- See cloaked content that attackers show only to ordinary users.
- Monitor the attack surface of their own organisation from outside the network.
- Test geo-dependent controls such as geo-blocking, WAF rules and fraud checks.
- Collect threat intelligence from public sources at scale.
Why not use the company network?
Attackers watch who visits their infrastructure. A visit from your corporate range tells them they've been found. Many phishing kits also block known security vendors and cloud ranges, showing a harmless page instead. Proxies give you neutral vantage points.
Which Webshare product
| Task | Webshare product |
|---|---|
| Visiting phishing and malicious sites | Rotating residential, a new session per investigation |
| Monitoring your own external services | Datacenter list in several countries |
| Testing your geo-blocking and WAF rules | Datacenter and residential in the relevant countries |
| Threat intel from public sources | Datacenter list, residential for protected sources |
Webshare's residential network with ASN targeting is useful for testing how your defences treat users of specific ISPs.
Operational safety
- Isolate. Investigate from disposable VMs or containers, never from analyst workstations.
- Don't authenticate. Never log into anything on a suspicious site or reuse credentials.
- Separate identities. Use separate proxy credentials or plans for investigation work, so a leak doesn't expose other projects.
- Log for evidence: time, URL, IP used, screenshots, HTML and hashes of downloaded files.
- Use IP authorization from your investigation hosts to avoid storing credentials in tools. See Webshare IP authorization.
Legal boundaries
Investigating public sites and testing your own systems is normal defensive work. Accessing systems without authorisation, testing third parties' defences without permission, or attacking anything is not. Proxies don't change what's legal; see are proxies legal. Provider acceptable use policies also apply, and some targets are restricted on residential networks.
Budget tip: Before scaling, run a short pilot with Webshare on your real targets and record success rate, latency and bandwidth per result. Our our complete Webshare guide explains which Webshare product fits which job.
Testing your own geo controls
- List the countries your controls allow and block.
- Request your services from IPs in each, with residential and datacenter types.
- Confirm blocks, challenges and allowed flows behave as designed.
- Repeat after rule changes.
Comparing providers
For another vantage point, Geonode offers residential, ISP and datacenter proxies with country to ASN targeting. See Geonode for cybersecurity research and Webshare vs Geonode ethics and sourcing.
An investigation workflow
- Intake: record the suspicious URL and where it was reported.
- Isolate: start a disposable VM or container with no access to internal systems.
- Proxy: route its traffic through a fresh residential session in the likely victim region.
- Capture: screenshot, HTML, redirect chain, certificate details and any downloads (hashed, not opened).
- Compare: load the same URL from a datacenter IP and note differences.
- Report: submit to hosting providers, registrars and blocklists with evidence.
- Destroy: delete the environment.
Attack surface monitoring
From outside your network, regularly check:
- Public services and login pages respond as expected.
- No unexpected services are exposed.
- Certificates are valid and not about to expire.
- Geo-blocking and WAF rules behave as designed in each country.
Datacenter IPs in several countries are cheap and sufficient for most of these checks.
Separating research identities
Use separate proxy plans or credentials for security research, so investigation traffic can't be linked to your company's marketing or scraping activity, and so a compromised investigation environment can't expose other credentials.
Proxy tip: For a second opinion on hard targets, run the same test through Geonode residential proxies, which support sticky sessions up to 24 hours and ASN targeting. We compare the two in Webshare vs Geonode.
Documentation for incident response
Record which IPs and locations you used for each investigation step. If a case goes to law enforcement or legal review, that context matters.
A real-world example
A company's security team receives reports of a phishing page imitating its login screen. From a disposable VM, they load the URL through a Webshare residential session in the country where reports came from and capture the page, redirect chain and hosting details. From a datacenter IP, the same URL shows a harmless placeholder, which confirms the kit is cloaking. The evidence goes to the hosting provider and registrar, and the page comes down within a day.
Not sure this is the right proxy type for the job? The best proxies in 2026 guide compares residential, ISP, datacenter and mobile options, and our cheap proxies guide covers budget picks that still work.
Key takeaways
- Proxies hide your organisation's ranges from attackers and reveal cloaked content.
- Use fresh residential sessions for phishing investigations and datacenter IPs for external monitoring.
- Always investigate from isolated, disposable environments.
- Log evidence carefully for takedowns and incident response.
- Only test systems you're authorised to test.
FAQ
Why use residential proxies for phishing investigations?
Phishing kits often block datacenter and security vendor IPs. Residential IPs see what victims see.
Is it legal to visit phishing sites through proxies?
Visiting public pages for defensive research is common practice, but follow your organisation's policies and local law.
Can I run penetration tests through Webshare?
Only against systems you're authorised to test, and within Webshare's acceptable use policy.
Can proxies hide my research from attackers?
They hide your organisation's IP ranges, but disciplined operational security matters as much as the proxy.
Should I download files from suspicious sites?
Only inside isolated environments, hashed and analysed with appropriate tools, never on normal workstations.
Can I use Webshare to test my own WAF rules?
Yes. Test from datacenter and residential IPs in the countries your rules allow and block.
Editorial note: Proxy providers change their pools, features and prices often, so treat any figures here as typical ranges at the time of writing and confirm current terms with the provider before you buy.