What you actually need to know
Will it work for your use case?
Pick the category closest to your goal. Each row is a site we actually tested.
✅ Works >80% success
⚠️ Partial 20–79%
❌ Blocked <20%
E-commerce & Price Monitoring
Mixed✅Amazon100%
✅Amazon.de99.9%
✅Macy's97.6%
✅Lowe's98.5%
✅Nordstrom89.4%
✅Best Buy88.4%
✅AliExpress89.0%
⚠️Family Dollar67.1%
⚠️eBay32.8%
❌Walmart0%
❌Home Depot0%
❌Costco0%
❌Etsy0%
❌Sephora1%
❌Shein0%
Travel & Hotel Prices
Mixed✅Booking.com99.9%
✅Agoda98.8%
✅Priceline98.7%
✅Trip.com98.3%
❌Expedia11.9%
❌Airbnb8.9%
❌Kayak0%
❌TripAdvisor0%
Job Listings & Freelance
Mixed✅We Work Remotely98.3%
✅Dice97.5%
✅FlexJobs94.7%
✅Remote.co88.6%
✅Workopolis82.6%
⚠️SimplyHired76.4%
⚠️Indeed42.6%
❌LinkedIn0%
❌Glassdoor0%
❌Upwork0%
❌Fiverr0%
❌ZipRecruiter0%
Deals & Coupon Sites
Mixed✅OzBargain99.5%
✅GrabOn99.5%
✅Meliuz90.9%
✅RetailMeNot90.7%
⚠️eBay32.8%
❌Rakuten8.4%
❌Slickdeals0%
❌Groupon0%
❌Capital One Shopping0%
News & Content
Mixed✅IMDB100%
✅BBC97.6%
✅Daily.dev99.9%
⚠️Reuters52.1%
❌Reddit0%
❌NY Times0%
❌Substack0%
Dev & Tech Communities
Mostly blocked✅Nodesk99.1%
❌GitHub0%
❌Stack Overflow0%
❌Reddit0%
⚠️These sites require auth — proxies alone can't help
The honest answer about bot protection
Which protection layers can Oxylabs get past?
Your success rate depends less on Oxylabs and more on who is protecting the target site.
No bot protection
56%
Average across 25 unprotected sites. Even without bot detection, rate-limits and geo-restrictions block 44% of requests. This is your realistic ceiling — not 100%.
Akamai Bot Manager
43%
Akamai is inconsistent — Amazon and Booking work perfectly (100%), while Walmart and Home Depot are completely blocked (0%). Akamai's configuration varies hugely per customer.
Cloudflare
35%
Harder than Akamai at this proxy tier. Cloudflare's JS challenge causes failures even for residential IPs. LinkedIn, Groupon, Slickdeals: 0%. But Dice and Daily.dev: 97–100%.
PerimeterX
0%
Complete wall. Fiverr, Target, Upwork, Wayfair — zero successful responses across every session and every concurrency level. Residential IPs alone are not enough. Browser-level fingerprinting required.
Running multiple requests at once?
When does scaling up get you blocked?
Good news globally: success rate barely drops from 1 to 16 concurrent. Bad news: some sites have a specific threshold where everything breaks at once.
−3pp
Drop in success rate from c1 to c16 across all 61 sites
−79pp
Drop for workopolis specifically at c16 — from 100% to 21%
c8→c16
Most site-level cliffs happen at this jump, not earlier
| Site | Protection | c1 | c2 | c4 | c8 | c16 | Verdict |
|---|---|---|---|---|---|---|---|
| workopolis | — | 100% | 97.5% | 100% | 94.4% | 20.9% | Hard cliff at c16 |
| Best Buy | — | 97.5% | 84.2% | 85.4% | 86.9% | 86.3% | Early drop, then stable |
| Remote.co | Akamai | 95% | 95% | 86.3% | 83.1% | 83.4% | Gradual drop from c4 |
| Amazon | Akamai | 100% | 100% | 100% | 100% | 100% | No cliff — scale freely |
| Booking.com | Akamai | 100% | 100% | 100% | 100% | 99.7% | No cliff — scale freely |
| Daily.dev | Cloudflare | 100% | 100% | 100% | 100% | 99.7% | No cliff — scale freely |
| Dice | Cloudflare | 100% | 95% | 98.8% | 97.5% | 96.3% | Stable at all levels |
Rule of thumb: test at c8 before committing to c16. Most cliffs happen at that boundary, not gradually.
The pool size claim vs reality
Providers advertise millions of IPs. Here's what you actually get.
We ran 200 sequential requests through each provider and recorded the egress IP every time. This is the only honest measure of rotation quality.
Oxylabs
200 / 200 unique
Every request got a fresh IP. Zero repeats. Median latency: 1,190 ms.
Decodo
199 / 200 unique
Also excellent rotation — but median latency was 3,913 ms (3.3× slower). Same pool diversity, half the real-world success rate. Pool size isn't the differentiator.
Webshare
free/10-IP plan
free/10-IP plan
10 / 200 unique
First repeat at request 6. By request 50 those 10 IPs have been seen by every site that logs traffic. Completely disqualifying for any target with bot detection.
The takeaway: pool size is a marketing number. Exit node reputation is what matters.
Oxylabs and Decodo both claimed millions of IPs — and both delivered 100% unique rotation in 200 requests. But Decodo's nodes are slower and less reputable. The sites see the same IP once, but they also see the ASN, the TLS fingerprint, and the timing patterns. Oxylabs routes through better-reputed exit nodes.
When Oxylabs isn't enough
What to try next when you hit a wall
Residential proxies are layer one. Some sites require layer two or three.
🧱 PerimeterX — Needs browser-level fingerprinting
PerimeterX fingerprints the TLS handshake, JS execution environment, and mouse/scroll patterns. A residential IP with a plain HTTP client looks like a bot regardless of where the IP comes from. Fix:
curl_cffi with Chrome impersonation, or a headless browser with stealth patches.Blocked sites: Fiverr, Target, Upwork, Wayfair, Zillow
🔒 Cloudflare JS Challenge — Try TLS impersonation first
Cloudflare's JS challenge needs a browser that can execute JavaScript. Some sites can be unblocked with TLS fingerprint impersonation (
curl_cffi) — it fools Cloudflare into thinking you're Chrome without running a full browser. If that fails, a stealth browser is the next step.Partially blocked: LinkedIn (0%), Groupon (0%), Slickdeals (0%) — but Dice (97%) and Daily.dev (100%) work fine with residential + TLS
🏬 Akamai hardened configs — Nothing works reliably
Walmart, Home Depot, Costco — both Oxylabs and Shifter got 0% here. These sites run Akamai with aggressive device fingerprinting and session warming requirements. Even browser-level tools have mixed results. Real session cookies from a warmed session are the most reliable path.
Both providers failed: Walmart, Home Depot, Costco, Kayak
📉 Sites with a concurrency cliff — Stay below the threshold
If a site works fine at c8 but fails at c16, you've found a rate-limit threshold. The fix isn't a better proxy — it's staying at c8 with a sleep between bursts. Adding more concurrent threads above the threshold won't help; it will make it worse.
Known cliff: workopolis drops 100% → 21% at c16
How we ran this
Methodology — short version
Target sites
61 real sites manually tagged by protection vendor (Akamai, Cloudflare, PerimeterX, none). No CDN proxies.
What counts as success
HTTP 200 with actual HTML content — not a block page, not a challenge page, not a redirect loop.
Ramp test
20 sessions at each of 5 concurrency levels (1, 2, 4, 8, 16). All results stored in SQLite, no CSV.
IP pool drain
200 sequential requests to an IP-echo endpoint through each proxy. Every egress IP recorded.
Transport
curl_cffi with Chrome TLS impersonation — same fingerprint for every provider so results are comparable.
Coming next
Home-IP baseline → lift score per site. Decodo full 61-site run (needs paid plan). Sustained 5-min throughput tests.