HTTP proxies and HTTPS CONNECT
An HTTP proxy understands HTTP requests. For an HTTPS destination, a client typically asks it to open a CONNECT tunnel and then negotiates TLS with the destination through that tunnel. Our HTTPS CONNECT list is the subset of HTTP proxies that passed HTTPS probes.
Use an http://IP:PORT proxy address for these entries. The destination can still be https://. A proxy URI beginning with https:// instead means TLS to the proxy itself, which is a different capability. Do not change the proxy URI scheme just because the destination is encrypted.
SOCKS5 and remote DNS
SOCKS5 can carry connections beyond HTTP and supports several address types. The protocol specification includes UDP association, but an individual endpoint or client may not support it. This catalog verifies TCP-based HTTPS only.
In curl, socks5:// resolves the destination locally while socks5h:// delegates hostname resolution to the proxy. Our checker uses remote resolution. An application may use different settings; verify its behavior instead of treating a SOCKS5 label as proof of DNS privacy.
SOCKS4 compatibility
SOCKS4 is an older protocol centered on IPv4 TCP connections. SOCKS4a adds a way to send a destination hostname to the proxy. Our checker uses SOCKS4a when requesting the HTTPS probe destinations, and the list remains labeled SOCKS4 for compatibility with common clients.
If your client supports SOCKS5, start with that category. Use SOCKS4 when your application specifically requires it, and confirm whether it supports remote hostname resolution. Neither version encrypts the transport on its own.
Try one explicit request
These examples use documentation addresses: replace the address and port with a freshly checked row. They change only the individual curl request.
curl --proxy http://203.0.113.10:8080 --max-time 10 https://api.ipify.org
curl --proxy socks5h://203.0.113.10:1080 --max-time 10 https://api.ipify.org
curl --proxy socks4a://203.0.113.10:1080 --max-time 10 https://api.ipify.orgCompare the response with your direct public IP. Keep certificate verification enabled. A failed request is a reason to check the protocol or try another endpoint, not to disable TLS validation. See the official curl manual for proxy option details.