A device, system, and method are directed towards determining network information. A network address is determined for a possible proxy. A determination is made whether a port on the possible proxy is open and/or if the port supports an HyperText Transfer Protocol (HTTP) proxy request. A request is sent to the possible proxy over the port, the request being configured to be forwarded to a network device. A type of the possible proxy is determined based in part on a behavior of the network device. The behavior may indicate whether the request is received by the network device, or whether the possible proxy obscures an origin of the request. The proxy type may include whether the possible proxy is a non-proxy, an anonymous-proxy, a controlled-proxy, and/or an open-proxy. Various types of network analysis may then be performed using the possible proxy and the determined proxy type.