Protocols

The residential gateway speaks HTTP, HTTPS, and SOCKS5 on the same port. The protocol is detected from the client handshake — you do not configure it server-side.

HTTP / HTTPS

The most widely supported. Both http:// and https:// targets work through the same connection.

# HTTP target
curl -x http://helo_s1a2b3c4d5e-type-res-region-us:[e-mail]:7777 \
     http://example.com

# HTTPS target (TLS to target is end-to-end)
curl -x http://helo_s1a2b3c4d5e-type-res-region-us:[e-mail]:7777 \
     https://example.com

For HTTPS targets the client sends CONNECT example.com:443 to the proxy, which opens a TCP tunnel. helodata never sees the request body.

SOCKS5

SOCKS5 is required for non-HTTP traffic (raw TCP, some DB clients, custom protocols) and is preferred by some scraping stacks for slightly lower overhead.

curl --socks5-hostname helo_s1a2b3c4d5e-type-res-region-us:[e-mail]:7777 \
     https://ipv4.icanhazip.com

--socks5-hostname (not --socks5) makes the proxy do the DNS lookup, which is what you want for geo-targeting to work correctly — otherwise the client resolves locally and leaks DNS.

Python SOCKS5

import requests

USER = "helo_s1a2b3c4d5e-type-res-region-us"
PASS = "PASSWORD"
proxy = f"socks5h://{USER}:{PASS}@gate.helodata.io:7777"

r = requests.get(
    "https://ipv4.icanhazip.com",
    proxies={"http": proxy, "https": proxy},
    timeout=30,
)

Note socks5h:// (with the h) — equivalent to --socks5-hostname, forces remote DNS.

Node.js SOCKS5

import { SocksProxyAgent } from "socks-proxy-agent";
import fetch from "node-fetch";

const agent = new SocksProxyAgent(
  "socks5://helo_s1a2b3c4d5e-type-res-region-us:[e-mail]:7777"
);
const res = await fetch("https://ipv4.icanhazip.com", { agent });

When to prefer which

Use case	Pick
Standard HTTP/HTTPS scraping	HTTP/HTTPS
Browser automation (Selenium, Playwright, Puppeteer)	HTTP/HTTPS
Raw TCP, MQTT, custom protocols	SOCKS5
Maximum throughput, minimum overhead	SOCKS5
Easiest debugging	HTTP/HTTPS — works with mitmproxy, browser devtools

What we do not support

• SOCKS4 / SOCKS4a — use SOCKS5
• HTTP/3 (QUIC) to the gateway — the target site can still serve HTTP/3 over the tunnel
• Plain (non-TLS) authentication over the public internet — credentials are always Base64-encoded by clients, but for sensitive workloads connect to the gateway over TLS (same port 7777; gateway auto-detects)

Common pitfalls

• DNS leak in SOCKS5 — always use socks5h:// / --socks5-hostname so the proxy resolves the target
• HTTP-only library forced to talk HTTPS — if your client requires http:// proxy URL even for HTTPS targets, that's normal; only the target URL is HTTPS
• curl ignoring HTTPS_PROXY — make sure both HTTP_PROXY and HTTPS_PROXY are set, lowercase variants too on some Unixes