Consumer protection × privacy tools

A U.S. IP wasn’t enough
to reach help.

Fifteen official consumer-reporting services. Four connection routes. Two visits each. An evidence-led look at where reporting journeys opened, stopped, or remained unverified.

120main browser journeys
14.gov hosts refused by this proxy
186saved main screenshots in this bundle

Disclosure: FreePolicyTools is a Proxy-Seller affiliate and received $10 in research credit. This study reused one purchased US IPv4 endpoint. It is a case study of specific routes, not a provider ranking.

The restriction was sometimes in the route.

The paid proxy returned PROXY_TARGET_FORBIDDEN for all 14 government entry hosts before our client began destination TLS. Control connections to other hostnames received tunnel approval. Those attempts establish a proxy-side restriction on this endpoint and account configuration.

The browser comparison also records website challenges, explicit denials, DNS failures, reporting notices and empty forms. A terms acknowledgement or CAPTCHA gate is kept separate from a visible form; no report was submitted.

A 403 at the proxy is a different event.

Browser → proxy: CONNECT reportfraud.ftc.gov:443
Proxy → browser: HTTP/1.1 403 Forbidden
                X-Proxy-Error-Message: PROXY_TARGET_FORBIDDEN

28 refusals across 14 government hostnames and two repeats. Six control attempts to other hostnames received tunnel approval. Inspect the diagnostic →

Two visits, shown separately.

Each cell preserves pass 1 and pass 2. The Kenyan normal connection is contextual, not a matched US residential control. “Form visible” describes the initial form; submission was not tested.

ServiceNormal connection · KenyaProton VPN · BostonProton VPN · New YorkPaid IPv4 proxy · US
FTC ReportFraud
P1 Questionnaire
P2 Questionnaire
P1 Questionnaire
P2 Questionnaire
P1 Questionnaire
P2 Questionnaire
P1 Proxy restriction
P2 Proxy restriction
FTC IdentityTheft
P1 Questionnaire
P2 Questionnaire
P1 Questionnaire
P2 Questionnaire
P1 Questionnaire
P2 Questionnaire
P1 Proxy restriction
P2 Proxy restriction
FBI IC3
P1 Acknowledgement gate
P2 Acknowledgement gate
P1 Acknowledgement gate
P2 Acknowledgement gate
P1 Acknowledgement gate
P2 Acknowledgement gate
P1 Proxy restriction
P2 Proxy restriction
CFPB
P1 Reporting notice
P2 Reporting notice
P1 Reporting notice
P2 Reporting notice
P1 Reporting notice
P2 Reporting notice
P1 Proxy restriction
P2 Proxy restriction
FCC
P1 Security challenge
P2 Security challenge
P1 Security challenge
P2 Security challenge
P1 Security challenge
P2 Security challenge
P1 Proxy restriction
P2 Proxy restriction
California
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Proxy restriction
P2 Proxy restriction
Texas
P1 CAPTCHA gate
P2 CAPTCHA gate
P1 Network error
P2 Network error
P1 CAPTCHA gate
P2 CAPTCHA gate
P1 Proxy restriction
P2 Proxy restriction
Florida
P1 Explicit denial
P2 Explicit denial
P1 Explicit denial
P2 Explicit denial
P1 Explicit denial
P2 Explicit denial
P1 Explicit denial
P2 Explicit denial
New York
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Proxy restriction
P2 Proxy restriction
Pennsylvania
P1 Explicit denial
P2 Explicit denial
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Proxy restriction
P2 Proxy restriction
Illinois
P1 Guidance only
P2 Guidance only
P1 Guidance only
P2 Guidance only
P1 Guidance only
P2 Guidance only
P1 Proxy restriction
P2 Proxy restriction
Ohio
P1 Network error
P2 Network error
P1 Acknowledgement gate
P2 Acknowledgement gate
P1 Explicit denial
P2 Explicit denial
P1 Proxy restriction
P2 Proxy restriction
Georgia
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Proxy restriction
P2 Proxy restriction
North Carolina
P1 Embedded form unverified
P2 Embedded form unverified
P1 Embedded form unverified
P2 Embedded form unverified
P1 Embedded form unverified
P2 Embedded form unverified
P1 Proxy restriction
P2 Proxy restriction
Michigan
P1 Explicit denial
P2 Explicit denial
P1 Form visible
P2 Form visible
P1 Form visible
P2 Form visible
P1 Proxy restriction
P2 Proxy restriction
Form visibleQuestionnaireAcknowledgement gateReporting noticeCAPTCHA gateSecurity challengeExplicit denialProxy restrictionNetwork errorEmbedded form unverifiedGuidance onlyInconclusive

60/60 service–route pairs had the same endpoint on both visits. Main observations: 2026-10-16T11:26:19.998Z to 2026-10-16T11:55:53.938Z.

Read the comparison with its limits.

One automated Chromium build, one ordinary Kenyan connection, two US Proton exits and one paid proxy cannot describe all users. Geography, DNS, route reputation, sequential timing and automated-browser treatment can all affect outcomes. Proton’s malware-only NetShield setting remained enabled. Longer NC checks exposed questionnaire text inside the child frame but still yielded blank full-page captures. A later viewport check reached a robot challenge. Visible form access remains unverified; the supplemental evidence is shown separately below.

Mandatory acknowledgements were left unchecked. No personal information, incident answers, login credentials or complaints were entered. CAPTCHA challenges were not completed. Read the complete article and interpretation →

The screenshot evidence.

Available pass-one final screens are shown below. The normal-connection Ohio screenshot could not be captured; its error is retained in the observation record. Open an image for its full page, or inspect the timestamped observation. All published main-stage captures and both passes are indexed in screenshots.json.

Focused validation.

Thirteen separate headed-browser checks followed the main experiment. In three longer NC checks, questionnaire text became available inside the SAS frame, but full-page screenshots remained blank in that area; visible embedded-form access therefore remains unverified. An additional normal-connection viewport check later reached a robot challenge, which was left unsolved. Ohio’s original Boston exit again reached its acknowledgement screen, while the original New York exit again returned a request rejection. Texas’s Boston DNS failure persisted with NetShield malware-only, off, then malware-only again at the same verified exit; its root cause remains undetermined. The headed proxy check again failed the FTC tunnel while the publisher HTTPS control loaded. Illinois still exposed guidance and printable resources in the selected journey. These exploratory checks do not replace the frozen main matrix.

Methods and open evidence.

Article draftVisit-level CSVProtocolFrozen sampleSummary JSONPrimary sourcesFile hashes