A Tiny Peek Into Unauthenticated SOCKS Proxies

**Executive summary:** This analysis examines internet-facing SOCKS services and finds that of ~3.49M advertised SOCKS hosts, 73,556 reported no authentication but only 968 actually proxied traffic (802 unique SOCKS hosts, 523 transit IPs); many usable proxies either egress from the listener itself or route via separate transit IPs, with notable aggregation around specific transit ranges (e.g., 156.254.39.0/24 and related blocks) and visible administrative dashboards, and GreyNoise telemetry shows a non-trivial subset of these hosts/transit IPs have been observed engaging in scanning or malicious activity, indicating exposed proxy infrastructure can be discovered and abused.