Email Security Proxies: Scan Links From IPs Attackers Cannot Profile

Quick answer

Email security scanners need rotating residential proxies so each link detonation comes from a fresh consumer IP that phishing kits cannot match to a known security vendor range. Geonode residential provides 2.5M IPs online across 195+ countries with per-request country targeting. Where a vendor must present stable allow-listed addresses to customers, ISP proxies from $1.25/IP give static IPs with unlimited bandwidth.

Why email link scanning breaks without the right proxies

Modern phishing kits are built to defeat the scanner, not the user. The kit checks the visiting IP against lists of security vendor ranges, cloud providers and known sandbox egress. On a match it returns HTTP 200 with a harmless page, a 404, or a redirect to the legitimate brand, and your gateway marks the link safe.

Kits also geofence. A lure aimed at a bank's customers in Germany serves the credential form only to German consumer IPs; everyone else sees a blank page. A scanner egressing from one region misses every campaign targeted elsewhere.

Volume adds a second failure mode. A gateway following many thousands of links a day from a small fixed range hits HTTP 429 on URL shorteners, redirectors and CDN edges, and that rate limit becomes a scanning blind spot. Email security proxies fix both problems: each click exits from a different consumer IP in the right country, and no single address carries enough volume to be throttled or profiled.

Which Geonode proxy type fits

For time-of-click and time-of-delivery scanning, the recommended option is Residential Proxies. The pool holds 2.5M IPs online with 30–50M unique IPs rotating monthly, so repeated detonations never reuse an address often enough for a kit to build a reputation on it. Country targeting across 195+ countries lets the scanner match the recipient's region. Rotating mode gives a new IP per request; a sticky session up to 24 hours holds one IP when a kit requires several steps.

ISP proxies fit a different need. Some vendors must publish fixed egress IPs so customer mail systems and partner APIs can allow-list them. Geonode ISP proxies are static IPs from real ISPs with unlimited bandwidth per IP, from $1.25/IP: a second pool for the allow-listed path, not for detonation.

Datacenter proxies are the wrong fit here, since kits treat datacenter ASNs as scanner traffic.

Residential — Best for: Link detonation, geofenced phishing, redirect chains; IP source: Real consumer devices, 195+ countries; Session: Rotating or sticky up to 24 h; Price from: $0.27/GB at volume
ISP (static residential) — Best for: Allow-listed vendor egress, partner APIs; IP source: Static IPs from real ISPs; Session: Unlimited, static; Price from: $1.25/IP
Datacenter — Best for: Non-attacker targets such as reputation feeds; IP source: Datacenter ranges, rotating; Session: Rotating; Price from: $0.14/GB

How to set it up

Sign up and start the $5 three-day residential trial. Point one detonation worker at the proxy and compare verdicts against your current egress on a day of real mail.
Derive the target country from the recipient's mailbox region or the impersonated brand, and append it to the proxy username so each detonation matches the lure's geography.
Run detonation in rotating mode. Only add a session id when a kit's flow spans several pages and you need the same IP for the whole chain.
Keep the sandbox browser's user agent, language and timezone consistent with the chosen country. A German IP with a US locale is an easy tell for the kit.
Record exit country, status code, final URL and a screenshot hash per detonation so verdict disputes can be replayed and shared with the customer.

# verify endpoint against docs.geonode.com before publishing
import requests, uuid

USER = "USERNAME"
PASS = "PASSWORD"
HOST = "premium-residential.geonode.com:9000"

def detonate(url, country, sticky=False):
    user = f"{USER}-country-{country}"
    if sticky:
        user += f"-session-{uuid.uuid4().hex[:8]}"
    proxy = f"http://{user}:{PASS}@{HOST}"
    headers = {"Accept-Language": f"{country},en;q=0.5"}
    r = requests.get(url, proxies={"http": proxy, "https": proxy},
                     headers=headers, timeout=25, allow_redirects=True)
    return {"status": r.status_code, "final_url": r.url,
            "hops": len(r.history), "bytes": len(r.content)}

print(detonate("https://short.example/x9Qz", country="de"))

Get the exact snippet for your language from the API Code Generator in the dashboard.

Email-security-specific settings that matter

Rotate by default, stick on demand

Every detonation should start from a fresh IP, so drop the session suffix in the username. When a kit chains a CAPTCHA, a fake login and an OTP form, open a sticky session for that one scan and close it when the verdict is in. Never reuse a session across messages.

Match country to the recipient

Geofenced kits serve the payload only to the targeted region. Pull the country from the mailbox location or the impersonated brand's home market and set -country-xx per request. Geonode supports country, state, city and ASN targeting; state and city cannot be combined on one request.

Keep fingerprints coherent

The proxy changes the IP, not the browser. Align Accept-Language, timezone and screen profile with the exit country, and use a new browser context per detonation so cookies from one scan never reach the next.

Throttle per target host, not globally

Geonode sets no fixed thread limit, so concurrency is your choice. Apply per-host throttling on shorteners and redirectors, retry once on HTTP 429 or 403 from a different exit, and treat a blank page after a redirect as a rescan trigger from a second country.

Log for replay

Store exit country, timestamp, every redirect hop, final status and a content hash. When a customer asks why a message was blocked or delivered, you can show exactly what the link served to which region.

What Geonode gives you for email security scanning

2.5M residential IPs online and 30–50M rotating monthly, so detonations never repeat an address pattern.
195+ countries with country, state, city and ASN targeting for geofenced kits.
Rotating per request or sticky up to 24 hours for multi-step kits.
ISP proxies from $1.25/IP for allow-listed static egress.
HTTP, HTTPS and SOCKS5, no fixed concurrency limit, 24/7 support.

Pricing for email security scanning

Residential traffic starts at $0.27/GB at volume. The entry plan is 10 GB for $7.92 a month, 50 GB is $34.65, and a 3-day trial costs $5. Plans are pay-as-you-go with no contract, which suits scanners whose volume follows mail traffic. Link detonations are small requests, so a modest plan covers a lot of scans. ISP proxies for allow-listed egress start at $1.25/IP. Datacenter for non-attacker targets starts at $0.14/GB. See all tiers on the pricing page.

FAQ

Why do email security proxies need residential IPs?

Phishing kits compare the visitor's IP against lists of security vendor, cloud and sandbox ranges and serve a decoy on a match. A residential IP in the lure's target country is not on those lists, so the scanner sees the real credential form and blocks the message.

Can email security proxies give me fixed IPs for customer allow-lists?

Yes. Geonode ISP proxies are static IPs from real ISPs with unlimited bandwidth per IP, from $1.25/IP. Use them for the allow-listed path to customer mail systems and partner APIs, and keep rotating residential for the detonation itself.

How many detonations can I run in parallel?

Geonode sets no fixed thread or concurrency limit on residential plans. Your practical ceiling is the per-host rate limit of the shortener or redirector you are following, so throttle per target domain and spread requests across countries and sessions.

Does the proxy handle JavaScript-heavy phishing pages?

The proxy transports the request; rendering is your sandbox browser's job. Route Chromium or Playwright through the proxy with HTTP or SOCKS5 and keep the browser locale aligned with the exit country so the kit sees a coherent visitor.

What are the limits and compliance rules?

Use the proxies only to scan mail for organisations you operate or are authorised to protect. Respect platform terms and rate limits on third-party services such as shorteners. Geonode's acceptable use policy prohibits fraud, spam, credential abuse and any attack on third parties.

What if the link serves different content on a second scan?

That is usually geofencing or a kit that burns the URL after one visit. Rescan from a different country and a new exit, compare content hashes, and treat divergence between regions as a strong phishing signal rather than noise.

Start

Run a day of real mail through a residential exit for $5 and compare verdicts. Get started with the 3-day trial, or contact sales for volume pricing, allow-listed ISP IPs and a combined setup for your gateway.