Threat Intelligence Proxies: Collect IOCs Without Exposing Your SOC

Quick answer

For threat intelligence collection you need two proxy pools: residential IPs for visiting phishing pages, forums and paste sites that profile their visitors, and datacenter IPs for pulling bulk feeds and resolving thousands of domains per hour. Both keep your corporate ranges out of attacker logs. Geonode residential covers 195+ countries with sticky sessions up to 24 hours; datacenter starts at $0.14/GB.

Why threat intelligence collection breaks without the right proxies

Attackers log every visitor to their infrastructure. A phishing kit that sees a request from a security vendor's ASN or a cloud range serves a benign decoy page, returns HTTP 403, or geofences the payload to the victim's country. Your analyst records "clean" and the campaign keeps running.

Paste sites, underground forums and code-sharing platforms rate-limit by IP. Pulling a few hundred pastes from one address triggers HTTP 429, CAPTCHAs or a silent shadow-limit where search results come back empty.

There is also an attribution problem. If every probe comes from the same static egress, the operator learns which IPs belong to your SOC and can tell when you are investigating. Threat intelligence proxies solve both issues: IP diversity keeps collectors under rate limits, and non-attributable exits make the request look like any other visitor from the targeted region.

Which Geonode proxy type fits

Most threat intelligence workloads mix two patterns, and the right proxy differs for each.

For interactive collection, such as fetching a phishing page the way a victim in Brazil would see it or following a geofenced redirect chain, use Residential Proxies. The pool has 2.5M IPs online and 30–50M unique IPs rotating monthly across 195+ countries. Country, state, city and ASN targeting reproduce the victim's vantage point, and sticky sessions up to 24 hours hold one IP through a multi-page kit.

For bulk feeds, domain list resolution and certificate transparency lookups, use Rotating Datacenter Proxies from $0.14/GB. Nobody profiles a feed fetch by IP reputation. ISP proxies fit when a partner feed requires an allow-listed static IP.

Residential — Best for: Phishing pages, forums, geofenced payloads; IP source: Real consumer devices, 195+ countries; Session: Rotating or sticky up to 24 h; Price from: $0.27/GB at volume
ISP (static residential) — Best for: Allow-listed partner feeds, stable collectors; IP source: Static IPs from real ISPs; Session: Unlimited, static; Price from: $1.25/IP
Datacenter — Best for: Bulk feeds, domain lists, enrichment; IP source: Datacenter ranges, rotating; Session: Rotating; Price from: $0.14/GB

Recommendation: residential for anything that touches attacker-controlled infrastructure, datacenter for everything else.

How to set it up

Create an account and add a residential plan. The 3-day trial costs $5 and is enough to validate that your collectors see the same content a victim does.
Build two proxy profiles in your collector: one residential with country targeting, one datacenter with -type-datacenter. Route by target class, not by job.
Pin a sticky session per investigation so redirect chains and multi-step kits stay on one IP. Drop the session suffix for feed pulls so each request rotates.
Log the exit IP, country and response hash for every fetch. You need it to prove what the attacker served to which region and when.
Set a retry policy that switches session id on HTTP 403 or 429 and re-fetches from a second country when the page returns an empty body.

# verify endpoint against docs.geonode.com before publishing
import requests

USER = "USERNAME"
PASS = "PASSWORD"
HOST = "premium-residential.geonode.com:9000"

def fetch(url, country="br", session=None, datacenter=False):
    user = USER
    if datacenter:
        user += "-type-datacenter"
    else:
        user += f"-country-{country}"
        if session:
            user += f"-session-{session}"
    proxy = f"http://{user}:{PASS}@{HOST}"
    r = requests.get(url, proxies={"http": proxy, "https": proxy},
                     timeout=30, allow_redirects=True)
    return r.status_code, r.url, r.text

# phishing page as a Brazilian victim would see it
print(fetch("https://suspicious.example/login", country="br", session="case-4471")[0])
# bulk feed through datacenter
print(fetch("https://feed.example/domains.txt", datacenter=True)[0])

Get the exact snippet for your language from the API Code Generator in the dashboard.

Threat-intelligence-specific settings that matter

Match the victim's geography

Phishing kits often serve the payload only to the targeted country and a decoy everywhere else. Set -country-xx to the region named in the lure, and when a campaign targets a city or ISP, add state or ASN targeting. Note that state and city cannot be combined on one request.

Sticky per case, rotating per feed

Use a session id per investigation so a kit's multi-page flow sees one consistent visitor. Switch to rotating, no session suffix, for feed collection and domain enrichment where each request is independent. Mixing the two on one profile makes the exit behaviour unpredictable.

Isolate the sandbox network

Route only the collector through the proxy, never the analyst workstation. Combine the proxy with a disposable browser profile and a clean user agent per case so cookies, canvas fingerprints and timezone do not link two investigations to one team.

Back off on signal, not on schedule

Treat HTTP 403, 429 and an unexpected decoy page as signals to rotate session and country, then retry once. Do not hammer the same host; attackers watch their logs and an unusual burst from one region tells them a researcher is present.

Log for evidence

Record exit IP, target country, timestamp, status code, final URL after redirects and a content hash. This turns a fetch into evidence you can attach to a takedown request or share with a partner CERT.

What Geonode gives you for threat intelligence

2.5M residential IPs online across 195+ countries for region-accurate views of attacker pages.
Country, state, city and ASN targeting to reproduce any victim vantage point.
Sticky sessions up to 24 hours for multi-step phishing kits and forum logins you own.
Datacenter rotation from $0.14/GB for bulk feeds and domain enrichment.
HTTP, HTTPS and SOCKS5 support, 24/7 support, card and crypto payment.

Pricing for threat intelligence

Residential starts at $0.27/GB at volume. The entry plan is 10 GB for $7.92 a month, 50 GB is $34.65, and a 3-day trial costs $5. Everything is pay-as-you-go with no contract, so a SOC can scale up during an active campaign and back down afterwards. Datacenter proxies for bulk feeds start at $0.14/GB. ISP proxies for allow-listed collectors start at $1.25/IP. Full details and volume tiers are on the pricing page.

FAQ

Why use threat intelligence proxies instead of a VPN?

A VPN gives you one or a handful of fixed exits that attackers quickly fingerprint and block. Proxies give per-request control over country, ASN and session, so each investigation looks like a different visitor and bulk feeds never hit a single-IP rate limit.

Residential or datacenter for visiting phishing pages?

Residential. Phishing kits commonly check the visitor's ASN and serve a decoy to cloud and datacenter ranges. A residential exit in the lure's target country sees the real payload. Keep datacenter for feeds and enrichment where no one inspects the visitor.

Can I reproduce what a victim in a specific city saw?

Yes. Append country and city, or country and state, to the username. Geonode residential supports country, state, city and ASN targeting, though state and city cannot be combined on a single request. Use a sticky session to keep that vantage point across the redirect chain.

How do threat intelligence proxies handle malware downloads?

The proxy only transports the request. Download samples into an isolated sandbox, never onto an analyst machine, and keep the proxy credentials inside that sandbox. Geonode supports HTTP, HTTPS and SOCKS5, so sandbox tooling can connect without a browser.

What are the limits and compliance rules?

Use the proxies only for defensive research on systems you are authorised to examine. Respect platform terms and rate limits on forums and paste sites. Geonode's acceptable use policy prohibits fraud, spam, credential abuse and any offensive activity against third parties.

How much bandwidth does a typical collector use?

It depends on your target mix. Phishing pages and forum threads are small, usually kilobytes per fetch, so residential traffic stays low. Bulk feeds and domain lists can be large, which is why the fact sheet points them to datacenter at $0.14/GB.

Start

Validate your collector against a live campaign for $5. Get started with a 3-day residential trial, or contact sales if your SOC needs volume pricing, allow-listed ISP IPs or a mixed residential and datacenter setup.