Surfshark
surfshark.com · 2 records in Egress and tunnels, IP and proxies · JSON
Records 2
- paidSurfshark (exit addresses)
IP and proxiesidentity email?card?evidence measuredstale on 2026-12-05
- fails: egressSurfshark (paid)USD 2.49/month
Egress and tunnelsno free tieridentity email?card?limit write-gatedevidence documentedstale on 2026-12-05
Surfshark (exit addresses)
IP and proxies- Free allowance
- No free plan read. The pricing page FAQ states monthly, 1-year and 2-year subscriptions; the amounts did not load in the captured text, so no price is recorded.
- Verdict
- paidno free allowance; listed for its price
- Cost
- no price stated
- Identity
- email?placeholder, not evidence; card unknown, phone unknown
- Binding limit
- noneno named constraint binds
- Evidence
- measured4 sources; a live request was made and its output kept
- Freshness
- stale on 2026-12-05checked 2026-11-04 (live); stale on 2026-12-05
| Free tier | No free plan read. The pricing page FAQ states monthly, 1-year and 2-year subscriptions; the amounts did not load in the captured text, so no price is recorded. unit none; metered on none; The price is the vendor's plan rate for the subscription whose exits are classified here; the exit-address measurement itself has no price. |
|---|---|
| Price | none stated |
| Limits |
|
| Binding | none No limit kind binds the record: it measures exit addresses and states no byte quota or request rate. What matters is list membership: 137 of 142 sampled exits are on a datacenter list. |
| Identity | email (placeholder) unverified: the purchase flow was not read; an account is required to use the service. |
| Egress | unverified: no traffic allowance or per-GB price appears in the captured pages; metered is recorded false because no metered charge was read. free allowance: none published |
| Retention | not applicable: an address, not an object |
| Interface | unknown The server list at https://api.surfshark.com/v4/server/clusters/generic is the source of the exit addresses classified here. The schema interface enum has no token for a VPN tunnel, so the tunnel protocols are not recorded as an interface. |
| Tooling | The exit addresses are read from https://api.surfshark.com/v4/server/clusters/generic and classified with an IP-class detector; the service itself is reached with the vendor's own client or a WireGuard or OpenVPN configuration. |
| Composes with | A Worker or a free compute node dials the tunnel and the traffic leaves at one of these exit addresses, so the upstream sees an address in the ASNs listed here and not the caller's network. |
| Reliability | 137 of 142 sampled exit addresses are on a datacenter list and 113 of 142 on a VPN list, so a site that blocks those lists blocks most of this fleet; 0 of 142 are also on an abuse list. |
| Notes | List membership of 142 exit addresses (detector index version 20261103T163900Z-00d117b2, 2026-11-03): datacenter 137, VPN 113, abuse 0, none of the three 5. VPN list: 113 of 142, of which 108 are in the x4b VPN list. Definitions: datacenter is an address inside a range the x4b datacenter list publishes; VPN is inside the x4b VPN list or a per-provider server list; abuse is on at least one independent abuse family; none of the three states list membership, not physical siting. |
| Evidence note | measured The list membership, ASN spread and counts are measured: each address was answered by the detector at the stated index version. The plan price and the identity class are documented from the vendor's captured pages; where a page did not state them they are unverified. The sample is the addresses the vendor endpoint returned, not proof that every address a user is handed is in it. |
| Parsed numbers |
|
Evidence 4
| date | source | what it proved |
|---|---|---|
| 2026-11-03 | probe: https://api.surfshark.com/v4/server/clusters/generic | The vendor endpoint https://api.surfshark.com/v4/server/clusters/generic gave 142 IPv4 exit addresses, each answered by the address-class detector at index version 20261103T163900Z-00d117b2 on 2026-11-03. Datacenter list: 137 of 142; VPN list: 113 of 142 (108 in the x4b VPN list); abuse list: 0 of 142; on none of the three: 5 of 142. 18 distinct ASNs and 142 distinct /24s; largest ASN AS209854 Cyberzonehub Cyberzone S.A. with 65 addresses. |
| 2026-11-03 | probe: https://api.surfshark.com/v4/server/clusters/generic | Detector index version 20261103T163900Z-00d117b2 was the one every one of the 142 answers carries. |
| 2026-11-04 | surfshark.com/pricing | the plans are monthly, 1-year and 2-year subscriptions |
| 2026-11-04 | surfshark.com/pricing | one account has unlimited simultaneous device connections |
More fields 4
| rung | 4 |
|---|---|
| rung note | Addresses came from the vendor's own server list and each was classified; no exit was connected to, so the address a user is handed at connect time was not observed. |
| list membership | {"measured_on": "2026-11-03","n": 142,"datacenter": 137,"vpn": 113,"vpn_in_x4b": 108,"abuse": 0,"none_of_the_three": 5,"detector_index_version": "20261103T163900Z-00d117b2","probed_at": "2026-11-03T17:20:53Z","endpoint": "https://api.surfshark.com/v4/server/clusters/generic"} |
| asn diversity | {"measured_on": "2026-11-03","addresses": 142,"subnets_24": 142,"asns": 18,"largest_asn": "AS209854 Cyberzonehub Cyberzone S.A.","largest_asn_addresses": 65,"largest_asn_share": "46%"} |
Unknown values 2
- interface: the access interface was not established
- per object cap stated: the field does not apply to this kind of offer
Surfshark (paid)
Egress and tunnels- Free allowance
- No free tier, and the vendor refuses the feature: Surfshark VPN does not support port forwarding because it creates a potential network entry point that exposes devices to unauthorized connections.
- Verdict
- fails: egressdata cannot be read back out at a usable rate or price
- Cost
- USD 2.49/monthparsed from the record, in USD
- Identity
- email?placeholder, not evidence; card unknown, phone unknown
- Binding limit
- write-gatedthe feature is not offered at any tier: Surfshark VPN does not support port forwarding
- Evidence
- documented10 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-05checked 2026-11-04 (live); stale on 2026-12-05
| Free tier | No free tier, and the vendor refuses the feature: Surfshark VPN does not support port forwarding because it creates a potential network entry point that exposes devices to unauthorized connections. Pricing page 2026-11-04: Surfshark Starter at $2.49/mo, $67.23 for the first 27 months (24 months plus 3 extra); a 1-year plan is mentioned but its price is unverified: the page shows no 1-year figure. unit none; metered on none |
|---|---|
| Price | USD 2.49 per month on Surfshark Starter, USD 67.23 for the first 27 months (24 months plus 3 extra) |
| Limits |
|
| Binding | write-gated No inbound path exists, so no volume or identity constraint is reachable. |
| Identity | email (placeholder) unverified: the purchase flow was not read; an account is required to use the service. |
| Egress | unverified: no page read states a Surfshark traffic allowance.; ingress: none free allowance: none published |
| Interface | cli App and extension based. Protocols: WireGuard, IKEv2, OpenVPN (UDP or TCP) and Dausos (macOS app). Shadowsocks is not offered. No SOCKS5 proxy is offered (third-party report). Obfuscation: OpenVPN runs on obfuscated servers, and NoBorders covers restricted networks. P2P-optimized servers exist. |
| Tooling | Official apps; WireGuard supported for outbound. |
| Composes with | Client-side tunnel only. |
| Reliability | No inbound path exists at any tier. |
| Notes | A third-party guide from 2021 said the same thing, which makes the position at least five years old rather than a recent withdrawal. No conflict found. The dedicated IP product Surfshark sells is an address, not a forwarded port, and was not read. |
| Evidence note | documented The refusal is a direct vendor sentence on a vendor page read. Measured is impossible. |
| Parsed numbers |
|
Evidence 10
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | surfshark.com/blog/vpn-port-forwarding | Surfshark VPN does not support port forwarding, stated as the vendor's own answer, with security exposure given as the reason. |
| 2026-11-04 | surfshark.com/pricing | the Starter plan sale price is $67.23 for the first 27 months |
| 2026-11-04 | surfshark.com/features/surfshark-vpn-protocols | Surfshark offers Dausos, WireGuard, OpenVPN and IKEv2 |
| 2026-11-04 | support.surfshark.com/hc/en-us/articles/360010324739-What-pr | OpenVPN is selectable over UDP or TCP |
| 2026-11-04 | support.surfshark.com/hc/en-us/articles/360010324739-What-pr | OpenVPN on Surfshark uses obfuscated servers |
| 2026-11-04 | support.surfshark.com/hc/en-us/articles/10448039999122-Surfs | NoBorders is the restricted-network mode |
| 2026-11-04 | surfshark.com/blog/surfshark-will-stop-supporting-shadowsock | not published |
| 2026-11-04 | vpnalert.com/guides/surfshark-socks5/ | a third party reports no SOCKS5 proxy is offered |
| 2026-11-04 | surfshark.com/blog/surfshark-vs-ipvanish | the vendor blog lists P2P-optimized servers |
| 2026-11-04 | surfshark.com/pricing | Surfshark Starter is 67.23 USD for the first 27 months |
More fields 6
| wg path | native-conf |
|---|---|
| wg detail | WireGuard is a supported protocol under the vendor's own client; the config does not create an inbound path because none is sold. |
| ingress | none |
| volume stated | unverified: no page read states a Surfshark traffic allowance. |
| bytes transit | yes |
| transit note | Outbound only from a user's point of view. |
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer