How the Nefo Proxy Network Is Built

Proxy gateways: three regional entries, one address

You connect to relay boxes we run in three regions. Each box authenticates your login, meters your bytes and dials the residential pool from the entry nearest to it. Behind the relays sit the pool's own gateways — you never see them, and a change there never changes your endpoint.

Pinning a region

Use a regional hostname when you want a fixed entry — for an allow-list, or to sit next to your target. The dashboard picks the nearest region by default and lets you choose manually.

Mobile and IP Vault

Mobile ports are fixed host:port pairs on the same relays — the carrier gateway behind them can change without your endpoint changing. IP Vault ports are served from the European relay, where the held sessions live.

Datacenter

The datacenter pool has one entry, reached through the same nearest-region address on its own port range, 19000–19012.

Proxy ports and protocols: HTTP, SOCKS5 and UDP

The same login works on every port. The port chooses the protocol and whether the exit rotates or sticks.

Residential entries. Ports 80 and 443 are kernel-level aliases of 9000 and 10000 for hosts that only allow those two outbound — same login, same metering.

Datacenter entries, on the same hostnames.

TLS to the proxy

Every HTTP port also accepts a TLS handshake first — an https:// proxy URL. The relays carry a publicly trusted certificate, renewed automatically, so a client that insists on an encrypted proxy hop works without changing port or login.

UDP over SOCKS5

SOCKS5 UDP ASSOCIATE is supported on the residential entries. The relay verifies each association with a STUN binding before handing it over, and datagrams are relayed and metered exactly like TCP bytes.

Authentication

Username and password, or an IP allow-list of up to 20 addresses per account. A wrong login is refused by our relay, in our name.

Rotating and sticky sessions, targeting tokens and pools

Targeting and session control travel in the username. A rotating port hands out a new exit on every connection; a sticky port holds the exit you got for as long as you asked, up to 24 hours.

Rotating

Ports 9000 and 11000. Each new connection is dialled from the pool afresh, so consecutive requests come from different addresses. No session token is needed — and one is refused.

Sticky

Ports 10000 and 12000, with a session token and a lifetime in minutes. The default lifetime is 10 minutes; the dashboard offers 5 min · 10 min · 30 min · 1 h · 3 h · 6 h · 12 h · 24 h. The same token gets the same exit for the lifetime, up to 24 hours.

When a home line drops

A sticky exit is a real household connection, and households go offline. When one does, the session is re-homed onto another address rather than erroring — expect the address to change before the timer ends in that case, and re-read it if your job depends on it.

The dashboard's generator builds the username for you and validates every token against the catalogue.

Pool 1

The default residential pool: sticky sessions up to 24 hours, targeting down to city and ISP.

Pool 2

A second, US-heavy pool: sticky up to 60 minutes, one of state, city or ISP per session.

Pool 3

The widest pool: the most IPs in smaller countries, Africa and Asia. State and city in the US.

Mix

Rotates across the pools you pick, in equal shares. A sticky session longer than 60 minutes runs on Pool 1 and Pool 3.

One balance, three premium pools: every GB works on Pool 1, Pool 2, Pool 3 and Mix.

Mobile

Each port is one modem on a real carrier. The address rotates when you ask — from the dashboard, the API, or a timer of 5, 30 or 60 minutes — and never underneath a running session otherwise.

IP Vault

A held address is a long-lived sticky session pinned to one household. While a port carries traffic the relay re-checks the exit roughly every 15 seconds and refuses the connection if the address has changed, so you never silently talk through a different house.

Coverage: what the targeting catalogue holds

227 countries, 22,417 cities and 14,252 ISPs and ASNs, counted from the targeting catalogue snapshot of October 10, 2026 — the same file the generator validates your username against.

A city is counted once per country even when it is filed under several regions.

Autonomous systems you can pin with an asn- token, per country.

Datacenter

75 countries, each dial-checked: a country is listed only where the exits we obtained geolocated to the country asked for. Catalogue snapshot of August 24, 2026.

By location

Every country, state and city in the catalogue has a page listing what can be targeted there.

• Look up every state, city and ISP by country
• Browse locations

How we measure the residential IP pool

Pool size is the number every provider prints and nobody measures. Ours is a measurement: our own sampler dials the pool the way a customer does and counts distinct exits.

The count grows with the sample length because a longer sample keeps finding new addresses. It is a lower bound on what the pool served, not the size of the pool.

The sampler

A worker dials a customer credential continuously in parallel bursts, reads the exit address, geolocates it and records every distinct IP with its country, ISP and whether it is hosted in a datacenter. In sweep mode it rotates through every country in the catalogue, so each country's pool is sampled in turn.

The catalogue

Countries, cities and ASNs come from the pool's own targeting options, snapshotted on October 10, 2026 and refreshed by hand when the pool changes. Cities are counted distinct per country; ASNs are summed.

Sourcing

Residential addresses come from partner networks that are contractually required to obtain explicit, revocable opt-in from participants. What we verify ourselves is what comes out of the pool: the sampler above, and the checks below.

Monitoring and automatic repairs

Every check below is a job on a schedule. Some repair what they find on their own — a mobile port re-issued, a vault address replaced. Gateway health only alerts a person: moving a region would change the exit IP under every sticky session, so that is a deliberate decision, not a timer.

What we do not claim

No uptime percentage appears here that was not recorded by the prober; the status page shows the recorded figure and the date recording began. The probes run from one host, so a problem between your network and ours can be real and still not show — if it is, tell us.

The status page

Current state, 90-day history per component and every incident as it was written at the time — also available as JSON for your own monitoring.

Network status and documentation

The status page shows what the prober recorded in the last 90 days. The docs show how to connect.

• Open the status page
• Read the docs

Related: coverage by country, rotating residential proxies, sticky session proxies and where residential proxy IPs come from.

Frequently asked questions