On October 13, 2026, five companies from the web data collection industry announced that they are now operating under a common umbrella called Source. This group includes Oxylabs, Decodo (formerly Smartproxy), Webshare, ScrapingBee, and Honeygain. For years, many customers have chosen these brands as their "primary" and "backup" providers, viewing them as competitors. Now it is official: they are one group. Let's explore what has united them, why this matters to anyone maintaining a backup pool of proxies, and how to check in an hour whether your backup provider is truly independent from your primary one.
What Happened: Five Brands, One Owner
According to Proxyway, Source describes itself as a "data ecosystem." The headquarters is based in Vilnius and, as Proxyway notes, it is part of a broader ecosystem called Tesonet. Here are some figures the group provides about itself:
- over 800 employees, including more than 350 developers and engineers;
- over 180 patents and 215 trademarks;
- 1.5 million requests per second in distributed systems;
- demand from AI agents and AI products has quadrupled over the past year.
The group has grown from Oxylabs. In July 2026, Oxylabs raised $130 million from Warburg Pincus at a valuation of $3.6 billion, marking its first external round. Connections between the brands have developed over the years: Oxylabs acquired Webshare in 2022, ScrapingBee in 2025, and Honeygain has been a primary partner for Oxylabs in sourcing residential IPs since 2021. The connection between Decodo and Oxylabs, as noted by Wilson's Media, was not publicly evident before the launch of Source. A notable detail: the CEO of Source, Vitautas Savickas, led Decodo until March 2026.
How the Brands Share the Market
- Oxylabs — large business and AI laboratories;
- Decodo — mid-tier segment;
- ScrapingBee — API for developers;
- Webshare — advanced solo users and small teams;
- Honeygain — an application that pays ordinary people for the "extra" traffic from their devices.
Formally, the brands remain independent: they have their own teams, pricing, products, and clients. Source claims that it does not sell anything itself but centralizes patents, procurement, hiring, and compliance. Whether the brands share IP pools or infrastructure is not disclosed by either Source or industry publications. However, this is the main concern for customers.
Why This Matters for Your Backup Pool
A backup pool of proxies is necessary in case the primary one fails: the target site has banned the provider's subnets, the provider experiences an outage, or conditions or prices change. We discussed scenarios and architecture of backups in our analysis of when backup proxy pools really save accounts. The main rule is simple: the backup should be from a different provider and ideally from different sources of IPs.
The consolidation under one owner complicates this rule more than it seems. There are three levels of dependency, and the brand on the website reflects only the first:
- Legal. Who owns the company and whose decisions determine the prices, rules, and fate of the service.
- IP Source. Where the residential addresses come from: proprietary application or SDK, a partner program like Honeygain, or wholesale purchases from another provider.
- Infrastructure. The gateways through which traffic flows, their hosting, and networks.
Two "different" providers can overlap at any of these levels. If the IP source overlaps, the anti-bot system of the target site, having learned to recognize these addresses, will block both pools simultaneously, rendering the backup useless exactly at the moment it was intended to be used.
IP Overlap Can Occur Even Without a Common Owner
It is important not to turn this news into a conspiracy theory. IP overlap occurs among companies that are not connected: the residential proxy market is structured multilayered, and many brands resell addresses from large wholesale networks, while the networks themselves purchase traffic through the same applications and SDKs. Therefore, it is essential to check not only "who owns it" but also "where the addresses come from" and "do they overlap in practice."
How to Check if Your Backup Provider is Independent: 5 Steps
The check takes about an hour and consumes a couple of hundred megabytes of traffic. Do this before the backup is needed.
Step 1. Legal Entity and Owner
Open the Terms of Service and Privacy Policy of both providers: they will indicate the legal entity, country of registration, and address. Next, check the company registry of that country and the "About Us" section or press releases. A matching address, the same directors, or mention of a common group is a reason to consider the providers as one supplier. It is also useful to look at the payment descriptor in the statement: it often names the actual legal entity rather than the brand.
Step 2. Source of Residential IPs
Ask support directly: "How do you obtain residential IPs? Proprietary application, SDK in third-party applications, partners, or wholesale purchases?" A reputable provider will respond at least in general terms. If both mention the same traffic monetization program or evade the question, consider the source to be common. This question is not trivial from a security perspective: on October 16, GBHackers, citing GreyNoise, described a campaign where attackers exploited vulnerabilities in D-Link NAS, video recorders, and SAP NetWeaver to secretly install a legitimate application, Pawns.app, on others' devices, turning them into commercial residential nodes. At least 143 devices in 34 countries were affected. IPRoyal names Pawns.app as its direct partner in sourcing residential IPs; however, as the publication emphasizes, there is no data indicating that any of the providers directed the campaign. The takeaway for customers: transparency of IP origin is also a matter of how clean the addresses you receive are.
Step 3. Overlap of Outgoing IPs
This is the main technical test. Take rotations from both providers in the same country and make 500–1000 requests to a service that returns your IP. Save the lists and compare:
- exact IP matches — a direct sign of a common pool;
- subnet /24 matches — a sign of a common source or common operators;
- distribution by ASN — if the same networks dominate both lists in similar proportions, the sources are likely close.
A minimal script in Python:
import requests
def collect(proxy_url, n=500):
ips = set()
for _ in range(n):
try:
r = requests.get("https://api.ipify.org",
proxies={"http": proxy_url, "https": proxy_url},
timeout=15)
ips.add(r.text.strip())
except requests.RequestException:
pass
return ips
a = collect("http://login:[email protected]:port")
b = collect("http://login:[email protected]:port")
net24 = lambda s: {".".join(ip.split(".")[:3]) for ip in s}
print("unique IPs:", len(a), len(b))
print("common IPs:", len(a & b))
print("common /24:", len(net24(a) & net24(b)))ASN for the obtained addresses can be determined using any IP geolocation service or a local database. How to correctly interpret the number of unique addresses in the sample was discussed in the article how to check the real size of a proxy pool with 1000 requests. A short rule: a few percent of common /24 in a large pool is a normal background for one country, while dozens of percent of common exact IPs effectively indicate one pool.
Step 4. Gateways and Infrastructure
Check where the hosts of the gateways of both providers resolve (using the dig or nslookup commands) and which networks own these addresses. The same hosting does not prove anything, but a common range of gateway addresses, identical port schemes, and login formats, similar responses to authorization errors — are already signals that one platform may stand behind different brands. In such cases, a gateway failure could take both services down simultaneously.
Step 5. Joint Ban Test
The most practical check. Take a target site where the primary provider is already encountering CAPTCHAs or blocks, and run the same scenario through the backup with the same headers and browser profile. If the backup is blocked at the same frequency and at the same steps, it is not a backup for that site, even if the owners are different. Repeat the test once a month: pools change.
Which Backup to Choose for Different Tasks
- Parsing and price monitoring. The independence of the IP source and gateways is the most important. A reasonable scheme is to have a backup of a different type: if the primary pool is residential proxies, a backup for less demanding purposes can be data center proxies, and vice versa.
- Multi-accounting and social media. Here, the backup should match the type of the primary; otherwise, the platform will notice a change in the "profile" of the network. For mobile scenarios, it makes sense to keep a backup on mobile proxies with operators not present in the primary pool.
- Critical tasks with SLA. Maintain two suppliers with different owners and different origins of IPs and check for overlap using steps 3 and 5 at least once a quarter.
What Else Changes with the Merger
Consolidation has a second side. The group claims that a common voice is needed to advocate for "responsible access to public web data," and Wilson's Media reminds us that Oxylabs remains a defendant in a lawsuit filed by Reddit in October 2025 alongside SerpApi, Perplexity, and AWMProxy. For the customer, this means a simple thing: the legal and reputational risks of one brand now potentially affect the entire group. Decisions regarding usage rules, pricing, and acceptable purposes may also begin to be coordinated.
At the same time, the brands continue to be sold as separate services, and nothing prevents you from using any of them. The only change is that choosing two of them as "primary and backup" without verification is no longer advisable.
Conclusion
The launch of Source is a good reason to reconsider your backup scheme. The brand name says nothing about the independence of the provider: the owner, IP source, and infrastructure matter. Check the legal entities, ask about the origin of the addresses, compare outgoing IPs and subnets, and run a joint ban test. If the overlap is significant, you do not have two providers, but one with two accounts. It is better to find this out now than on the day your primary pool fails.