Is this an appropriate use of your network?

Defensive research is — fetching and analysing publicly reachable infrastructure to understand a campaign targeting your organisation or your customers. Attacking infrastructure, scanning networks you do not have authorisation for, delivering malicious traffic or anything else our acceptable use policy prohibits is not, and we act on reports.

Why not investigate from a datacentre VPS?

Because datacentre ranges are widely filtered, and many kits serve a benign decoy to anything that looks like infrastructure. A residential or carrier exit sees the page the intended audience sees, which is the thing you are trying to record.

Can I see the variant served to mobile users?

With ARC Mobile, yes — genuine 4G/5G carrier IPs in Germany, the UK, the US and Japan. Kits that branch on the network, rather than only the user agent, will serve the mobile lure to a carrier exit and not to a residential one.

Will my organisation be identifiable in the request?

Not from the exit address — the request arrives from a pool IP, not from your range. Everything else is still yours to control: user agent, headers, cookies and timing all leak far more than most investigators expect, and we do not strip or rewrite them.

How quickly can I scale up during an incident?

Bandwidth is bought in a single checkout and credited to the balance, so scaling up is a purchase rather than a contract change. Very large orders can be held briefly for a manual release before their gigabytes are credited — the balance shows them as pending until then.

Use case · Threat intel

Proxies for cybersecurity and threat intelligence

Investigating a phishing kit or a typosquat from a corporate range tells the operator who is looking. Fetch it from an ordinary consumer exit in the region being targeted, and see the payload the intended victims are served.

Get started See pricing

Pay per GB · No subscription · Prices in EUR, excl. VAT

Illustration. The URLs and values are fictional; the connection string is the real grammar.

€2.00
per GB on ARC Fast, excl. VAT: −44%
at 1 TB (€1.12 / GB): 185+
countries, city targeting: Never
expires — no subscription

The problem

What goes wrong without the right IPs

Corporate ranges are recognisable

Security vendor and enterprise netblocks are well known and widely filtered. A kit that detects one serves a benign page, and your investigation records nothing.

Payloads are geo-fenced

Campaigns commonly target one country and serve a decoy elsewhere. From outside the fence there is nothing to analyse.

Attribution runs both ways

Every fetch from your own range tells the operator which organisation is investigating, and when. That is intelligence you are giving away for free.

Infrastructure is short-lived

A domain can be up for hours. If a run is throttled and misses the window, the evidence is simply gone — there is no re-fetch of a site that has been taken down.

Mobile users get a different lure

Many kits branch on the network as well as the user agent. A carrier exit is the only way to see the variant aimed at phone users.

Setup

Recommended setup

Match the exit to the audience the campaign is targeting, and keep the investigating organisation out of the request.

Plan	Role	Session	Targeting	Price
ARC Fast Rotating residential	Default for investigation Residential exits in the targeted region, held steady so a redirect chain resolves from one address rather than looking like several unrelated visitors.	Sticky, 10 minutes per target	Country + city	€2.00 / GB €1.12 at 1 TB (−44%)
ARC Ultra Premium residential	For heavily filtered infrastructure Our largest premium residential pool, for kits that filter aggressively enough that ARC Fast comes back with the decoy.	Sticky per target	Country + city	€3.50 / GB €2.17 at 1 TB (−38%)
ARC Basic Rotating ISP	For bulk indicator checks Cheap, high-volume liveness and content checks across an indicator list, at our lowest price per GB.	Rotating	Country	€0.75 / GB €0.59 at 1 TB (−21%)

Prices are list prices in EUR, excl. VAT. Volume discounts apply automatically at checkout — full ladder on the pricing page.

Illustration

What monitoring 5,000 indicators costs

An illustration with round numbers — your pages, payloads and retry rate will differ. The arithmetic is the real price ladder.

Assumptions

Indicators tracked: 5,000
Checks per day: 6
Weight per check: 120 KB
Deep captures: 200 a day at 3 MB
Bandwidth per month: ≈ 126 GB

On ARC Basic

€85.68per month, excl. VAT

126 GB bought in one purchase at €0.68 / GB (−9% volume rung, applied automatically).

The same 126 GB on ARC Fast: €171.36 at €1.36 / GB. Route only the jobs that need it through the pricier pool.

Two workloads in one number: cheap liveness checks across the whole indicator list, plus a smaller set of full captures. Splitting them across ARC Basic and ARC Fast is what keeps the total where it is.

Bandwidth never expires, so a bigger single purchase is only ever cheaper per GB. See the ladder.

Works with anything that takes a proxy URL

Python requests / httpx
curl
Playwright
Go net/http
Docker
n8n

FAQ

Questions

Something not covered? Write to contact@arcproxies.io.

Get started

Buy a gigabyte and try it on your own targets.

No subscription, no sales call. Code WELCOME15 takes 15% off your first purchase, and whatever you do not use is still there next quarter.

Create your account Questions first? contact@arcproxies.io

AI agents

Bring your own residential IPs to browser-use, Playwright, Crawl4AI, n8n and any MCP tool — one sticky session per task, billed per GB.

Multi-accounting

One stable exit per profile, held as long as the session needs, so the accounts you are entitled to run stay separate in an anti-detect browser.

QA & localisation

See your own site the way a user in Tokyo, São Paulo or Munich sees it — currency, language, consent banner, CDN edge and all — before they report it.

Web scraping

A second provider that just works — Scrapy, requests, Crawlee or Playwright, self-serve, no sales call, bandwidth that never expires.