Which Top Sites Block Datacenter IPs — November 2026

This is the number that decides whether a scraper works. The same request, sent in the same second from a residential IP, went through on every one of those 38 hosts — so the refusal is about where the request came from, not what it asked for. The reverse happens too, and far less often: 4 sites refused the residential request while serving the datacenter one.

“Undisclosed” means the host announced no CDN in its response headers — not that it has none.

The full set is a free API: GET https://proxmint.com/api/site-blocks — add ?format=csv for a spreadsheet, ?blocked=all for every measured host. No key, CORS open, published CC BY 4.0.

Tranco ranks by DNS query volume, not by visitors. A CDN hostname or a nameserver domain answers billions of lookups and serves no homepage to anybody, so it places high on a list of “top websites” without being one. 225 of the top 1,000 names — 23% — have no address at their apex to answer a request at all. We resolve every name before measuring it, and dial none of these.

Not a tail effect: the highest-ranked of them is number 7, and the share barely moves the whole way down the list. It is also why our denominator is 775 rather than 1,000, which is not a cosmetic difference. A name with no address of its own can still draw an answer from a residential exit whose resolver replies regardless, and that answer reads exactly like “the datacenter request was refused and the residential one succeeded”. Before we resolved names first, that alone put 42 sites on this list that did not belong on it. Every row is in the API with its reason, so the count is checkable rather than merely stated.

1. Take the list. The Tranco daily top 1,000, re-fetched every run so the sample is reproducible. Tranco ranks by DNS traffic, so we resolve each name first and measure nothing that has no address to answer from.
2. Ask twice, at the same moment. A plain GET / from our own datacenter IP and the same request through a residential exit, following up to three redirects. Status and headers only — never the page body.
3. Confirm before counting. A refusal is re-asked before it counts: twice from the datacenter, where the IP never changes, and up to three times residentially, where every attempt draws a different exit. The residential success is the other half of the finding, so a pair that would be published is measured again from a fresh exit — a difference we cannot reproduce is not published.
4. Publish only the difference. A site counts as blocking datacenter IPs when the datacenter request was refused — 403, 429, a Cloudflare challenge, or no answer at all — and the residential request genuinely succeeded.
5. Exclude what we could not measure. Two different exclusions, counted apart because they are not the same claim. 225 names were never dialled: they have no apex address, being the infrastructure domains Tranco ranks by DNS traffic — akamai.net, gtld-servers.net — which serve no homepage to anyone. The other 91 we did dial, and one leg never heard back from the origin. That includes banks, payment services and government sites, which our residential network does not connect to by default. A site that refuses both vantage points is not excluded: that is a measurement, and its answer is that it does not single out datacenter traffic.

On the user-agent: we identify ourselves honestly rather than impersonating a browser. We checked what that costs — across the top hosts, a browser user-agent and realistic Accept headers changed no status on either leg. The refusals we record are about the IP, not about how we introduce ourselves.

Data as of Oct 7, 2026, 7:36 AM UTC. · Companion measurement: how reliable free proxies actually are