This dossier exists to say plainly: Oxylabs is not a VPN and should never appear in a consumer VPN shortlist. It is one of the two dominant corporate web-data platforms (with Bright Data) - a Vilnius-based, until-2025 bootstrapped company now valued at $3.6B after Warburg Pincus' $130M investment, selling 175M+ residential IPs, mobile/ISP/datacenter networks and scraping APIs to 15,000+ enterprise clients and, increasingly, to AI-agent builders. As infrastructure it is genuinely excellent and independently verified: Proxyway's April 2026 benchmarks give it the largest pool and rock-solid 99.93% success, it holds ISO 27001/SOC 2 certifications with pentest summaries published, and - unusually for this industry - Spur, the firm that tracks proxy networks, concedes Oxylabs is among the few providers that require KYC video calls with all customers and block resale. But the privacy ledger is the point: the residential pool is built from consumer devices - sourced via Honeygain (the bandwidth-sharing app that HN research and r/Honeygain voices treat as Oxylabs-owned, paying users cents per GB while Oxylabs sells the same bandwidth for up to $8/GB), ISP partnerships and app-developer SDKs - academic work has catalogued Oxylabs-branded mobile proxyware apps with 76M+ Google Play installs (NDSS 2021) and reports Scattered Spider used residential proxies including Oxylabs for credential-stuffing campaigns, Reddit is suing Oxylabs in SDNY for allegedly circumventing Google's SearchGuard to stripmine Reddit content, and as a customer your identity is KYC-verified and your traffic is metered and attributable. Where you do not need a commercial VPN we say so - and almost nobody shopping for personal privacy needs this product.
audit7 red flagsfacts verified - operator pages (homepage, main pricing, residential-proxy pricing with FAQ, about, Warburg Pincus investment blog, Reddit-lawsuit response blog, legal timeline, IP Transparency blog, SafeBase Trust Center), the Proxyway review and Source.ai news article, TechRadar, City A.M., Yahoo/Entrepreneur, KrebsOnSecurity, the arXiv proxyware paper, the HN Algolia API and the arctic-shift Reddit archive all fetched live 2026-11-03. Limits observed: arctic-shift body searches for pre-2026 comment ranges returned HTTP 422 (index limitation), so Reddit voices are drawn from 2026 comments; r/proxy returned zero archived matches; spur.us returned HTTP 429 and en.wikipedia.org/wiki/Oxylabs returned HTTP 404 (no article exists), so Spur's tracking figures are cited via KrebsOnSecurity; warburgpincus.com, globenewswire.com and pcmag.com returned HTTP 403 and Reuters HTTP 401.
Reddit v. SerpApi, Oxylabs, AWMProxy and Perplexity (S.D.N.Y., filed Oct 22, 2025): the complaint (quoted by KrebsOnSecurity) alleges the proxy vendors circumvent Google's SearchGuard by 'masking their identities, hiding their locations, and disguising their web scrapers as regular people' to scrape Reddit content at scale, citing the DMCA anti-trafficking provision 17 U.S.C. 1201; Oxylabs says it is 'shocked and disappointed', argues no company owns public data, and is contesting - case active in 2026
The bandwidth-source question: residential IPs come from consumer devices via the Honeygain bandwidth-sharing app, ISP partnerships and app-developer SDKs; HN research threads connect Honeygain staff back to Oxylabs/Tesonet and a 2021 exclusive traffic deal, and an r/Honeygain voice states plainly that 'Honeygain is owned by Oxylabs... just the fancy customer-facing part of their business'; the operator's own IP Transparency FAQ concedes an IP can appear in multiple proxy networks and that third-party developers improperly aggregating bandwidth is 'abuse of Oxylabs policy'
Spur (the industry's proxy-tracking firm) lists OXYLABS_PROXY at 6,754,790 live IPs (#4 globally, Oct 2025, via KrebsOnSecurity) in an ecosystem it documents as polluted by botnet rental (Aisuru), Android SDKs and reseller schemes; the same article notes Oxylabs disputes the growth figures and - in Oxylabs' favor - that Spur regards Oxylabs and Luminati as the KYC-compliant exceptions
+4 more red flags - expand before signing up
Criminal misuse of the product category: an April 2026 arXiv paper reports Scattered Spider combined commercial VPNs with residential proxy services 'including Luminati and Oxylabs' for credential-stuffing and phishing, and builds on the NDSS 2021 measurement study that found Oxylabs-branded mobile proxyware on 86 APKs / 27 apps with 76,250,000 Google Play installs and consent dialogs that were 'often misleading or absent'
Conglomerate opacity: since Oct 13, 2026 Oxylabs, Decodo, Webshare, ScrapingBee and Honeygain sit under one Vilnius umbrella (Source.ai) that Proxyway places 'effectively within Tesonet's broader ecosystem' (the NordVPN group) - brands still sold and reviewed as rivals now share one owner, and TechRadar itself flagged that three of its nine best-proxy picks belong to that group
A decade of patent warfare with Bright Data: a Texas jury ordered Oxylabs to pay Bright Data ~$7.5M for willful infringement (Nov 2021, damages only); Oxylabs counter-sued and successfully invalidated Bright Data's key residential-proxy patents (Federal Circuit Aug 2025, Supreme Court refused review Feb 2026), while its own offensive patent case was stayed in March 2026
Review-site dependence: Proxyway - which rates Oxylabs its highest score ever and gave it the 2026 'Most Scalable Provider' award - sells a 35%-off affiliate code on the same page
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 2 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on Oxylabs yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Overview
Oxylabs homepage - live capture 2026-09-29
Oxylabs is not a VPN - it’s an enterprise web-data collection platform offering residential, mobile, ISP and datacenter proxies, scraping APIs, and AI-agent tools. Based in Lithuania and valued at $3.6B after a Warburg Pincus investment in 2026, it serves 15,000+ corporate clients. This is infrastructure for scraping, not consumer privacy; you must complete KYC, and your traffic is metered and logged.
Logging & privacy
Oxylabs makes no no-logs claim. Its Trust Center details internal audit logging and log management as security controls, confirming activity is recorded. While it holds ISO 27001 and SOC 2 certifications - covering security and confidentiality - these do not equate to privacy for users. The company enforces strict KYC, including video verification, and bills based on bandwidth consumed per request, meaning all traffic is tracked. Jurisdiction in Lithuania offers moderate privacy protections, but the absence of any no-logs policy means your data is neither anonymous nor private.
Pricing & the renewal trap
Oxylabs pricing page - live capture 2026-09-29
Pricing starts at $30/month for the Starter plan, with no separate intro or renewal rates - it’s a usage-based credit system that expires monthly. The $500 Flexible plan unlocks the advertised $4/GB residential rate, but users report being charged up to $8/GB. There is no refund policy for self-service purchases, and the derived_pricing shows no renewal trap because there is no renewal discount - just non-refundable, expiring credits. The real cost over three years is highly variable, but the three_year_cash_total is null, indicating no fixed long-term pricing.
Features & performance
Oxylabs apps / download page - live capture 2026-09-29
Oxylabs supports HTTP, HTTPS, SOCKS5 (with UDP/QUIC), HTTP3 and MASQUE tunneling, primarily via API, dashboard, Chrome extension and Android app. It offers dedicated IPs and tools like Web Unblocker for anti-bot bypass, but no kill switch, split tunneling or multihop. With coverage in 195 countries and 175M+ residential IPs, it excels in scale and reliability - Proxyway benchmarks show 99.93% success. However, it does not support P2P, streaming or personal anonymity use cases.
Ownership & track record
Oxylabs is part of Source.ai, a Vilnius-based umbrella formed in October 2026 that includes Honeygain, Webshare, ScrapingBee and Decodo - all effectively within the Tesonet ecosystem, which also birthed NordVPN. It has faced lawsuits, including a $7.5M patent ruling (later overturned) and a 2025 lawsuit by Reddit alleging circumvention of access controls. Academic research links its SDK to 76M+ Android app installs with deceptive consent. Despite red flags around bandwidth sourcing - notably via Honeygain, which users call “the customer-facing part of Oxylabs” - it is one of the few proxy providers Spur confirms enforces KYC and blocks resale.
Censorship resistance
Oxylabs is not designed for censorship circumvention. Its obfuscation tools - like MASQUE tunneling and Web Unblocker - are built to evade bot detection on websites, not state-level firewalls. It does not market or support use in censored countries like China or Iran. If you need to bypass national censorship, this is not the tool. Use a dedicated, audited no-logs VPN instead.
Verdict
Do not use Oxylabs if you want privacy, anonymity or to hide your browsing from your ISP. It is a corporate scraping platform that logs and bills your activity, requires real-identity KYC, and is actively sued for large-scale data harvesting. It’s excellent for AI teams and enterprises needing reliable, scalable web data - but irrelevant and harmful to personal privacy. Review sites like Proxyway, which promote Oxylabs with affiliate links, are part of the same ecosystem, raising serious conflict-of-interest concerns.
++ What holds up
Best-in-class, independently benchmarked infrastructure: 99.93% residential success rate and 0.60 s average response in Proxyway's April 2026 tests, the largest unique-IP pool the testers measured (fetched 2026-11-03)
Real published rate card with a $5 free welcome credit and no purchase required to try (live pricing page)
The most developed compliance posture in the proxy vertical: ISO/IEC 27001:2022, SOC 2 Type 2 + SOC 3 with pentest summaries on a public Trust Center, technology E&O/cyber insurance, KYC with video calls, strict no-resale policy (Trust Center + Spur via Krebs)
First residential proxy provider to publish an IP Transparency tool letting anyone check whether their IP was in the network in the last 30 days, naming the entry app (e.g. Honeygain) - a direct response to the industry's sourcing problem (operator blog, Sept 2026)
Recognition beyond affiliates: PCMag Editors' Choice 'Best for Enterprise-Level Clients' and CNET 'as close to perfect as it gets' per operator badges; Proxyway rates it 9.3/10, its highest score
-- What to watch
Not a consumer privacy tool: mandatory KYC, metered and attributable per-request billing, no anonymity guarantees - the opposite trade from a no-logs VPN
Premium pricing with no pay-as-you-go anymore: entry residential rate is $6/GB and the advertised $4/GB needs the $500/month plan; one HN commenter says the dashboard showed him $8/GB; unused credits expire monthly
Self-service purchases are explicitly non-refundable (operator FAQ), and Proxyway review-page comments (2024-2025) document denied refunds after bans and wrong-product purchases
Streaming, banking, government, ticketing, mailing and Apple domains are blocked on the residential network by design (operator FAQ) - it is built for scraping public data, nothing else
Dashboard security gaps Proxyway documents: no 2FA, no session management, no activity log
Pricing reality check
Intro price
$30 /mo
Notes
Usage-based subscription with a shared credit balance, live 2026-11-03. One subscription covers all products: Starter $30/mo, Basic $100/mo, Flexible $500/mo ('most popular'), Enterprise from $2,500/mo; a FREE tier carries $5 in welcome credits. Residential Proxies per-GB tiers: $6/GB up to 0.8 GB (Starter), $5/GB up to 20 GB (Basic), $4/GB up to 125 GB (Flexible), $2.50/GB at 1K+ GB (Enterprise). Mobile $7.50/GB entry down to $3.50/GB; ISP proxies from $1.50/IP; Dedicated Datacenter from $2/IP; Datacenter per-GB $0.60 down to $0.40; Web Unblocker $7.20/GB entry, $3/GB at scale; Web API /Search $1 per 1K searches, /Scrape from $0.50 per 1K results; Agent Browser $8/GB entry. Billing FAQ: charged monthly, credits deducted per product rate, unused credits expire at the end of the billing cycle, and 'You're billed for both the request and response traffic that passes through Oxylabs' proxy network... regardless of the HTTP status code returned. In other words, billing is based on bandwidth consumed, not on whether a request succeeds.'
yes - KYC procedure before use; among the strictest in the industry per an independent tracker
Payment
fiat
Apps
api, dashboard, chrome-extension, android-app
Check the renewal price above before any multi-year plan - true-cost calculator.
Is Oxylabs legit?
Legal domicile: Lithuania - Oxylabs UAB, HQ Svitrigailos st. 32, Vilnius (operator about page); bootstrapped until a $130M first outside investment from Warburg Pincus (July 2026) at a $3.6B valuation; part of the Tesonet ecosystem, and since October 13, 2026 one of five brands (Oxylabs, Decodo, Webshare, ScrapingBee, Honeygain) under the Vilnius-based Source.ai umbrella. Logging claim: No no-logging claim exists anywhere on the fetched operator pages - Oxylabs markets security certifications, insurance and an 'ethical procurement' framework, not customer anonymity; its Trust Center lists internal 'Audit logging' and a 'Log Management and Monitoring Standard' as security controls. - evidence class: no logging claim at all. No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - operator pages (homepage, main pricing, residential-proxy pricing with FAQ, about, Warburg Pincus investment blog, Reddit-lawsuit response blog, legal timeline, IP Transparency blog, SafeBase Trust Center), the Proxyway review and Source.ai news article, TechRadar, City A.M., Yahoo/Entrepreneur, KrebsOnSecurity, the arXiv proxyware paper, the HN Algolia API and the arctic-shift Reddit archive all fetched live 2026-11-03. Limits observed: arctic-shift body searches for pre-2026 comment ranges returned HTTP 422 (index limitation), so Reddit voices are drawn from 2026 comments; r/proxy returned zero archived matches; spur.us returned HTTP 429 and en.wikipedia.org/wiki/Oxylabs returned HTTP 404 (no article exists), so Spur's tracking figures are cited via KrebsOnSecurity; warburgpincus.com, globenewswire.com and pcmag.com returned HTTP 403 and Reuters HTTP 401. (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
On the website
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
Oxylabs homepage - live capture 2026-09-29Oxylabs pricing page - live capture 2026-09-29Oxylabs apps / download page - live capture 2026-09-29
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Based on our checks as of 2026-11-03: Oxylabs scores 3.3/10 in our weighted review. We logged 7 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do I actually get for $30/month?
You get the Starter plan: $30 in monthly credits, 0.8 GB of residential proxy bandwidth at $6/GB, access to APIs and tools, but no pay-as-you-go rollover - unused credits expire.
What is the renewal price and total cost over three years?
There is no renewal price - it’s a monthly credit system. The `renewal_ratio` is null and `three_year_cash_total` is null, meaning costs depend on usage and expire monthly; no long-term savings exist.
Is there any proof of a no-logs policy?
No. Oxylabs makes no no-logs claim. Its `logging_evidence` is "none" - in fact, its billing model confirms all requests are tracked and logged for metering.
Can I use this to bypass censorship in China or Iran?
No. Oxylabs is not a censorship-circumvention tool. It lacks features for evading national firewalls and is designed for web scraping, not personal anonymity.
Can I pay anonymously?
No. Oxylabs requires full KYC verification, including company or personal details and potentially video calls, before you can use any service.
What happens if Oxylabs shuts down or bans my account?
You lose access and any remaining credits. Accounts can be banned without refund, and there is no appeal process documented - your access is entirely at their discretion.
What’s the honest free or cheap alternative?
For personal privacy, consider a flat-priced, audited no-logs VPN like Mullvad or IVPN. For scraping, Zyte offers lower-cost APIs. For free bandwidth, Honeygain pays users to share their IP - but that’s how Oxylabs sources its residential network.
The meta-review: what the internet says about Oxylabs
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates Oxylabs. Every claim links to its source so you can verify it yourself.
What other reviewers say (2)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched 2026-11-03: highest-rated company on the site; Most Scalable Provider award 2026; affiliate links with code proxyway35 (35% off); April 2026 benchmarks - largest pool tested (3.24M unique IPs in 21 days global), residential 99.93% success / 0.60s avg, mobile 99.84%, datacenter 99.98%; residential IPs 'sourced via Honeygain (a bandwidth sharing app), direct partnerships with ISPs, and app developers'; KYC 'always necessary'; no 2FA/session management/activity log in dashboard; pay-as-you-go removed (mobile March 2026); restricted-target screenshot of prohibited domains; $130M Warburg investment at $3.6B; trial '7 days for companies, 3-day refund'; comments include refund-denial and mistaken-ban complaints (2024-2025).
Fetched 2026-11-03: Oxylabs, Decodo, Honeygain, Webshare and ScrapingBee announced the Source.ai umbrella ('data ecosystem for the next era of data intelligence'): 800+ people, 180+ patents, 350,000 customers in 180 countries; Vytautas Savickas CEO of Source.ai, Julius Cerniauskas Chairman of the Board; 'Source is based in Vilnius and effectively forms an ecosystem within Tesonet's broader ecosystem'; constituents keep independent products/customers while the mother organization allocates capital.
What users say (3)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched 2026-11-03 (378 hits): 2025-2026 voices - dashboard showed $8/GB vs the advertised $4/GB; restricted-targets read as reasonable; 'it slaps' production praise sits alongside 'one of the later data centers is oxylabs' bot attributions; Honeygain bandwidth-margin math (10c in, $8 out); Tesonet-umbrella commentary; Oxylabs as the invisible plumbing behind ChatGPT search; Scattered Spider proxy usage; an industry insider who 'will not use any of them, ever'; a KYC-relay attack scenario naming Luminati/Oxylabs; OxyMouse cited as table-stakes human-emulation tooling.
Fetched 2026-11-03: story index - 'Oxylabs (NordVPN) Fined $7.5M by jury for residential proxy botnet' (2021, TechRadar link), 'Connecting HoneyGain to NordVPN and Parent Company OxyLabs' (2023 Ask HN with LinkedIn-staffing evidence), 'Oxylabs' Company Group Acquires ScrapingBee' (2025), ScrapingBee's own acquisition post (July 2025), 'How to Detect Residential Proxies' (2026), xhr.dev Show HN listing Oxylabs among bypass services that 'either didn't work or required unnecessarily complex integrations', and 'Luminati vs. Oxylabs Patent Lawsuit Reached Final Dismissal' (2020).
Fetched 2026-11-03: r/webscraping voices - Oxylabs Web Scraper API praised for stability ('we're fixing selectors, not re-engineering proxy pools at 3am') and ScrapeSelect's independent 9-provider pricing table (Oxylabs Web API $450/$650 per 500K pages; caught Oxylabs' move to one subscription); r/Honeygain comment states 'Honeygain is owned by Oxylabs... just the fancy customer-facing part of their business'. Note: body searches for pre-2026 ranges returned HTTP 422 and r/proxy had zero archived matches, so Reddit coverage is limited to the 2026 window.
AI fact summary - everything we know, compressed
Generated by Qwen3 on 2026-11-09 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: Oxylabs is not a consumer privacy tool. It is a high-end, enterprise-grade web data platform designed for large-scale scraping, AI training, and anti-bot bypass - sold to corporations, not individuals seeking anonymity. You are paying for infrastructure, not privacy.
The logging truth: There is no no-logs claim - Oxylabs explicitly logs activity for billing and security, with audit logging as a certified control. All traffic is metered and billed by bandwidth, meaning every request and response is recorded. Based in Lithuania, it operates under EU jurisdiction but requires full KYC, making user activity fully attributable.
Pricing reality: Starts at $30/month with no introductory discount - this is a usage-based credit system where unused funds expire monthly. The advertised $4/GB residential rate applies only at scale (Flexible plan, 125GB+); users report being charged $8/GB unexpectedly. No refunds, no pay-as-you-go, and no rollover - it’s a use-it-or-lose-it model.
What reviewers say vs what users say: Proxyway gives Oxylabs a 9.3/10 and calls it “the best enterprise proxy provider,” but it runs affiliate links and promotes a 35% discount on the same page - a clear conflict. Users on HN and Reddit praise reliability (“it slaps”) but complain about opaque pricing, sudden rate changes, and account bans, while also noting Oxylabs’ role in a controversial data supply chain.
Who runs it: Oxylabs UAB, founded in 2015 in Vilnius by Julius Cerniauskas (Chairman), now led by CEO Vytautas Savickas. It is part of the Tesonet ecosystem (linked to NordVPN) and since October 2026 operates under the Source.ai umbrella with Honeygain, Webshare, and ScrapingBee - all sharing ownership despite being marketed as competitors.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 10[B] B: 7[C] C: 3[D] D: 0(D stays empty until our own test phase)
A serious budget proxy provider - and this dossier says plainly what that means: IPRoyal is not a consumer privacy VPN. It sells access to a 64M+ IP pool of…
crypto accepted
intro $7 /GB
United Arab Emirates - ToS v10 (effective 2026-10-15) and Privacy Policy v7 name 'IPRoyal Services FZE LLC ... incorporated in the United Arab Emirates, license No 4387, ... Ajman'; privacy policy is written under UAE PDPL (Federal Decree-Law No. 45 of 2021), not GDPR. Company started in 2020 in Lithuania (Lithuanian founders; the bandwidth app is run by 'IPRoyal Pawns UAB' per a 2026 GDPR complaint thread); HQ and contracting entity have moved to the UAEproxy service 11 d ago
This dossier exists to say plainly: Bright Data is not a VPN and should never appear in a consumer VPN shortlist. It is the market-leading corporate web-data…
audit
intro $4 /GB
Israel - Bright Data Ltd. (formerly Luminati Networks), HQ Tel Aviv area, Israel; majority acquired by London private investment fund EMK Capital in 2017proxy service 11 d ago
A competent budget proxy vendor for scraping and automation - and this dossier is honest that it is not a privacy product. Webshare is a California-founded…
intro $2.99 /mo
United States (about page: 'trusted technology company based in California, USA, founded in 2018'; ToS section 12.1: service deemed based in California). Ownership sits abroad: acquired by Oxylabs in late 2022, and since October 13, 2026 one of five brands (Oxylabs, Decodo, Webshare, ScrapingBee, Honeygain) under the Vilnius-based Source.ai umbrella, which Proxyway reports sits effectively within the broader Tesonet ecosystemproxy service 11 d ago
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.