# Two hostnames for the shared pools, one address per dedicated proxy.

Location is never in the hostname. Shared gateways read it from the username; dedicated proxies are fixed at the order.


## The table

| Network | Endpoint | HTTP(S) | SOCKS5 | Auth | Billing |
| --- | --- | --- | --- | --- | --- |
| Residential | res.hodlproxy.com | 9000 | 9001 | user:pass or whitelist | Per GB, never expires |
| Mobile, rotating | mob.hodlproxy.com | 9000 | 9001 | user:pass or whitelist | Per GB, never expires |
| ISP | your IP (list) | 8000 | 8001 | user:pass or whitelist | Per IP per term, unlimited traffic |
| Datacenter | your IP (list) | 8000 | 8001 | user:pass or whitelist | Per IP per term, 100 GB/IP/mo pooled |
| Mobile, dedicated | your device IP | 8000 | 8001 | user:pass or whitelist | Per device per term, unlimited traffic |


## One hostname, every location

Connect to `res.hodlproxy.com` from anywhere and ask for the exit you want in the username: `-cc-jp` for Japan, `-cc-us-state-tx-city-austin` for Austin, `-asn-3320` for Deutsche Telekom customers. There are no per-country hostnames to maintain, so changing market is a string change, not a configuration change. The mobile gateway `mob.hodlproxy.com` takes the same parameters.


## HTTPS targets

For an `https://` URL your client sends `CONNECT host:443` to port 9000 and the gateway opens a tunnel from the chosen exit. TLS runs end to end between your client and the target: the gateway never sees the plaintext, never terminates or re-signs the certificate, and does not alter the SNI. HTTP and HTTPS targets share the same port; there is no separate TLS port for the proxy hop itself.

> Warn: The hop from your machine to the gateway is not encrypted. With password authentication the Basic header travels in the clear on that hop; on networks you do not trust, use the [IP whitelist](https://hodlproxy.com/docs/authentication#ip-whitelist) or connect from a server you control.


## Dedicated addresses

An ISP proxy, a datacenter proxy or a mobile device is delivered as an IP address that answers on port 8000 for HTTP(S) and 8001 for SOCKS5. The list in your dashboard, and [`GET /v1/proxies`](https://hodlproxy.com/docs/api#get-v1-proxies), give one line per address:

```text
203.0.113.42:8000:u7f3a9c:kq2Lm8Pz1r
203.0.113.57:8000:u7f3a9c:kq2Lm8Pz1r
198.51.100.9:8000:d4c1e0:Zt6Hn3Vw9x        # a mobile device
```

Username parameters are ignored on dedicated addresses: a dedicated proxy is already one fixed location and one fixed IP.


## IP version and DNS

- Exits are IPv4. Targets that only publish an AAAA record are not reachable through the network.
- Hostnames are resolved on the exit side, so the target sees a DNS lookup from the same country as the request. With SOCKS5 use the `socks5h://` scheme so your client hands the hostname to the proxy instead of resolving it locally.
- `res.hodlproxy.com` and `mob.hodlproxy.com` resolve to the gateway cluster; do not pin their addresses in configuration, they change as capacity is added.


## Ports on the target

Any TCP port on the destination is allowed, with one exception: outbound port 25 (SMTP) is blocked on every network. UDP is not carried; see [Protocols](https://hodlproxy.com/docs/protocols).


## Timeouts and keep-alive

- A connection to the gateway with no traffic for 60 seconds is closed. Reopen it; the next connection picks a fresh exit unless you hold one with `-sid-`.
- Transfers have no duration limit as long as data flows, so large downloads and long-polling work.
- Keep-alive is honoured. Requests reusing one connection share one exit for the life of that connection; see [rotation](https://hodlproxy.com/docs/username-parameters#rotation-and-sessions).


Source: https://hodlproxy.com/docs/endpoints