# Proxy routing study: measured findings Status: local controlled phase completed; public HTTPS replication recorded separately when available. No paid proxy was used. Main run: `20261016T055751Z-r3`. 1,080 trials across 360 combinations, three repetitions each. Four client implementations were used; Node fetch was tested in two configuration modes. ## Healthy-proxy route matrix Entries show the observed route in HTTP / HTTPS / HTTP→HTTPS order. These are loopback fixtures, not public-IP anonymity measurements. | Client | Lowercase HTTP+HTTPS | Uppercase HTTP+HTTPS | HTTP variable only | Deliberate NO_PROXY exception | |---|---|---|---|---| | curl | proxy / proxy / proxy+proxy | direct / proxy / direct+proxy | proxy / direct / proxy+direct | direct / direct / direct+direct | | urllib | proxy / proxy / proxy+proxy | proxy / proxy / proxy+proxy | proxy / direct / proxy+direct | direct / direct / direct+direct | | requests | proxy / proxy / proxy+proxy | proxy / proxy / proxy+proxy | proxy / direct / proxy+direct | direct / direct / direct+direct | | node-default | direct / direct / direct+direct | direct / direct / direct+direct | direct / direct / direct+direct | direct / direct / direct+direct | | node-env | proxy / proxy / proxy+proxy | proxy / proxy / proxy+proxy | proxy / proxy / proxy+proxy | direct / direct / direct+direct | ## Failure behavior 28 client/configuration/path combinations used the proxy for every leg in all three healthy baselines. Across their 420 matched failure trials, 0 produced a direct origin request; 0 reached the origin by any route. This is evidence for failing closed within the tested conditions, not a guarantee for other applications, proxy protocols, destinations, versions, or operating systems. Direct traffic from default Node fetch, an explicit bypass, or an unconfigured scheme is classified separately from failure-triggered fallback. A returned HTTP 407 or 503 is a proxy response, not proof the destination received the request. ## Reproducibility and limits Fixture controls passed: True. SHA-256 evidence verification: True. All combination groups contain three trials: True. Route inconsistencies between repetitions: 0. Controller timeouts: 0. The controls verified direct attribution, proxied CONNECT attribution, and rejection of an unrelated certificate authority. Temporary CA trust was limited to test processes. The main evidence directory contains the exact source snapshots used for the run. The 360-trial exploratory pilot is excluded from these totals. Honeygain supplier setup evidence remains separate and does not establish customer relay or withdrawal effectiveness. No news coverage/backlink outcome is guaranteed. ## Article direction **Working title: “Proxy Configured, Traffic Direct: 1,080 Tests of Four Common HTTP Clients.”** Lead with the difference between an environment variable being present and a client actually engaging its proxy. The route matrix and HTTPS upgrade example are more defensible than a claim that paid proxies themselves leak. The mechanisms are already documented; the contribution is the original reproducible measurement set. The public HTTPS replication below supports the HTTPS configuration findings; redirect behavior remains a local-fixture result. ## Primary references - [curl environment proxy semantics](https://everything.curl.dev/usingcurl/proxies/env.html) - [Requests proxy configuration](https://requests.readthedocs.io/en/stable/user/advanced/#proxies) - [Python 3.13 urllib proxy handling](https://docs.python.org/3.13/library/urllib.request.html) - [Node v25.2.1 environment proxy option](https://nodejs.org/download/release/v25.2.1/docs/api/cli.html#node_use_env_proxy1) - [ProxySeller public offer: clause 1.7](https://proxy-seller.com/trust-center/public-offer/) ## Public HTTPS replication Run `20261016T060134Z-public`: 80 attempts to api.ipify.org, two repetitions per combination. A loopback-bound researcher proxy forwarded CONNECT tunnels to the public destination. Proxy and client used the same Internet egress, so these are routing measurements, not evidence of hiding a public IP behind a remote paid proxy. | Client | Config | Mode | Observed routes (counts) | |---|---|---|---| | curl | explicit-bypass | healthy | direct: 2 | | curl | explicit-bypass | refused | direct: 2 | | curl | http-only | healthy | direct: 2 | | curl | http-only | refused | direct: 2 | | curl | lower-both | healthy | via-research-proxy: 2 | | curl | lower-both | refused | inconclusive-no-valid-response: 2 | | curl | upper-both | healthy | via-research-proxy: 2 | | curl | upper-both | refused | inconclusive-no-valid-response: 2 | | node-default | explicit-bypass | healthy | direct: 2 | | node-default | explicit-bypass | refused | direct: 2 | | node-default | http-only | healthy | direct: 2 | | node-default | http-only | refused | direct: 2 | | node-default | lower-both | healthy | direct: 2 | | node-default | lower-both | refused | direct: 2 | | node-default | upper-both | healthy | direct: 2 | | node-default | upper-both | refused | direct: 2 | | node-env | explicit-bypass | healthy | direct: 2 | | node-env | explicit-bypass | refused | direct: 2 | | node-env | http-only | healthy | via-research-proxy: 2 | | node-env | http-only | refused | inconclusive-no-valid-response: 2 | | node-env | lower-both | healthy | via-research-proxy: 2 | | node-env | lower-both | refused | inconclusive-no-valid-response: 2 | | node-env | upper-both | healthy | via-research-proxy: 2 | | node-env | upper-both | refused | inconclusive-no-valid-response: 2 | | requests | explicit-bypass | healthy | direct: 2 | | requests | explicit-bypass | refused | direct: 2 | | requests | http-only | healthy | direct: 2 | | requests | http-only | refused | direct: 2 | | requests | lower-both | healthy | via-research-proxy: 2 | | requests | lower-both | refused | inconclusive-no-valid-response: 2 | | requests | upper-both | healthy | via-research-proxy: 2 | | requests | upper-both | refused | inconclusive-no-valid-response: 2 | | urllib | explicit-bypass | healthy | direct: 2 | | urllib | explicit-bypass | refused | direct: 2 | | urllib | http-only | healthy | direct: 2 | | urllib | http-only | refused | direct: 2 | | urllib | lower-both | healthy | via-research-proxy: 2 | | urllib | lower-both | refused | inconclusive-no-valid-response: 2 | | urllib | upper-both | healthy | via-research-proxy: 2 | | urllib | upper-both | refused | inconclusive-no-valid-response: 2 | Raw public IP responses were processed in memory and saved only as salted within-run comparison labels. TLS verification remained enabled. Failed or invalid responses are inconclusive; they are not automatically scored as a privacy pass.