ProxyRange

Shifter

10 GB costs $20 at checkout; 5 of 30 providers charge less.

Sourcing check
Unclear
Can you test it?
Open to testing
ID check
Not stated
Unused traffic
Expires

shifter.io

Sourcing check

Unclear

Public sources raise problems with how its IPs are sourced. From 9 dated, linked items of evidence, listed below.

  • High confidence
  • Evidence: 9
  • Reviewed 23 Oct 2026

Evidence

  1. Krebs on Security (28 Jul 2022) reported that data exposed in a breach showed Microleaves, then being rebranded to Shifter.io, had a long history of new proxies supplied by affiliates incentivized to spread its software, despite its claim of user consent.

    “a lengthy history of being supplied with new proxies by affiliates incentivized to distribute the software any which way they can”

    Supply and public reports High confidence Seen 23 Oct 2026 krebsonsecurity.com

  2. Kaspersky's threat encyclopedia listed the detection Trojan-Proxy.Win64.Microleaves, a software family it said uses the user's connection as a proxy without notifying the user; the entry names Microleaves, the service Krebs reported was being rebranded to Shifter.io.

    “Trojans of this family use the user’s connection as a proxy to access network resources without notifying the user.”

    Supply and public reports Medium confidence Seen 23 Oct 2026 threats.kaspersky.com

  3. Shifter's Terms of Service named no legal entity, only 'Provider', said the Provider may later form a business entity such as an LLC, and chose California law with arbitration in San Francisco; its privacy policy and About page named no company either.

    “Customer is hereby informed that Provider may form a business entity, including, without limitation, a limited liability company.”

    Web and company links High confidence Seen 23 Oct 2026 shifter.io

  4. Krebs on Security (28 Jul 2022) reported Shifter's PR and marketing manager saying Microleaves had been sold about three years earlier to Super Tech Ventures, a Taiwan private equity company that search engines seemed to know nothing about.

    “sold it three years ago to the current owner — Super Tech Ventures, a private equity company based in Taiwan.”

    Web and company links Medium confidence Seen 23 Oct 2026 krebsonsecurity.com

  5. Proxyway's Shifter review (published 27 Nov 2023, updated 13 Feb 2026) said Shifter was known as Microleaves before a 2020 rebrand, started in 2012, reportedly changed hands, and that very little is known about its current owners.

    “Before a rebrand in 2020, Shifter was known as Microleaves.”

    Web and company links Medium confidence Seen 23 Oct 2026 proxyway.com

  6. Shifter's residential pricing page described its IPs as real residential IPs from ISPs, but none of the Shifter pages we read (About, pricing, terms, privacy policy, a blog post on ethical sourcing) said how its own residential IPs are obtained.

    “Real residential IPs from ISPs avoid blocks and CAPTCHAs that datacenter proxies can't bypass.”

    Supply and public reports High confidence Seen 23 Oct 2026 shifter.io

  7. Shifter's privacy policy shared 23 paragraphs with anyIP's word for word apart from the brand name, including an unusual 'revenue model' line; a web search found no other site using that line, though shared wording can come from a common template.

    “In addition, our revenue model is designed so that the Services have 3rd party services implemented inside them for providing analytical services.”

    Docs fingerprint Low confidence Seen 23 Oct 2026 shifter.io

  8. Synthient's Shifter profile said Shifter was observed obtaining IPs through Microleaves components in the Windows apps Online Guardian and Advanced Windows Manager, gave them a provisional MEDIUM risk score, and said static inspection did not establish a user consent flow.

    “Shifter is observed leveraging Microleaves / Online Guardian to obtain IP addresses, with the SDK distributed across Windows”

    Supply and public reports High confidence Seen 23 Oct 2026 synthient.com

  9. Trend Micro's research (27 Jul 2023) listed Shifter.io at $149.99 a month in a table of popular residential proxy and proxyware services, without findings about its sourcing.

    “Table 1. Service rates of popular residential proxy and proxyware service providers in 2022”

    Supply and public reports High confidence Seen 23 Oct 2026 trendaisecurity.com

What we checked
  • Supply and public reports Read Google GTIG's IPIDEA report (29 Jan 2026) brand list for Shifter or Microleaves. Nothing found
  • Supply and public reports Read Google GTIG's NetNut post (3 Jul 2026); it names no white-label brands. Nothing found
  • Supply and public reports Read FBI IC3 PSA I-031226-PSA (12 Mar 2026); it names no providers. Nothing found
  • Supply and public reports Searched AppEsteem's Deceptor and certified lists (data updated 23 Oct 2026) for Shifter, Microleaves, Online Guardian and online.io. Nothing found
  • Supply and public reports Read Krebs on Security's Kimwolf (Jan 2026) and Aisuru (Oct 2025) articles and Lumen's proxy-ecosystem report for Shifter. Nothing found
  • Supply and public reports Checked EWDCI's homepage member logos for Shifter. Nothing found
  • Supply and public reports Searched Spur's public service-tag list: a SHIFTER_PROXY tag exists (tracking only). Found
  • Web and company links Searched the web for Shifter's owner and for Super Tech Ventures: only the Krebs report and review sites turned up. Nothing found
  • Supply and public reports Verification pass (2026-10-23): re-read Kaspersky's Trojan-Proxy.Win64.Microleaves entry; still listed, names Microleaves only. Found
  • Docs fingerprint Verification pass (2026-10-23): ran exact-phrase web searches for two distinctive sentences shared by the Shifter and anyIP privacy policies; no other site turned up. Nothing found

What you’d pay

The lowest total a new customer pays in one purchase for at least this much traffic, before tax. Promo codes are never applied.

10 GB $20

$20 less than the median of 29 providers ($40)

Checked 22 Oct 2026 Source

Terms and limits

Minimum
$10 Checked 22 Oct 2026 Source
Unused traffic
Expires Checked 22 Oct 2026 Source
Trial
Free trial with a set amount of traffic; length depends on the account, converts to a paid plan Checked 22 Oct 2026 Source
Refunds
Within 3 days of the first purchase if under 50% of the plan's bandwidth is used Checked 22 Oct 2026 Source
SOCKS5
Yes Checked 22 Oct 2026 Source
Finest targeting
City, ASN Checked 22 Oct 2026 Source
Sticky up to
30 mins Checked 22 Oct 2026 Source
Pool size (claimed)
205M+ residential IPs Checked 22 Oct 2026 Source
Payment
Card, PayPal, Crypto Checked 22 Oct 2026 Source
ID check
Not stated

Can you test it?

Open to testing

No clause on benchmarking, monitoring, publishing results or IP mapping (terms carry no last-updated date; the Appropriate Use Policy they incorporate by reference is not published on shifter.io).

Read 22 Oct 2026 Their terms Read weekly, same text since 22 Oct 2026

Measured tests

Its terms allow independent testing. Results appear here after our first monthly run on a plan we buy ourselves.

What every provider’s terms say about testing

Where its gateway leads

Shifter’s gateway fra.p.shifter.io runs on DigitalOcean, LLC.

What public DNS showed for the gateway hosts it documents. Anyone can repeat these lookups.

DNS for shifter.io is hosted by ns1.shifter.io, ns2.shifter.io.

Mapped 22 Oct 2026 Documented here

Changes to its pages

No changes seen on the pages we read every week.

Similar price at 10 GB

Are you Shifter?

Reply to anything on this page at facts@proxyrange.com. A reply that addresses the facts appears here, next to the sourcing check, and every correction goes in our public log.