Today K-12 technology departments are tasked with holding back a growing threat. As long as schools have put restrictions on technology, students have searched for workarounds to get to their favorite non educational sites, mostly gaming and porn. What started as by-passing content filters with simple proxy sites, has evolved into a sprawling ecosystem of professional proxy technologies that are purpose-built to try and defeat school content filtering solutions. 

Most content filter options still rely on an outdated internet model: a site gets visited, gets classified, and its domain lands on a blocklist. That model assumed domains were somewhat scarce and stable. Neither is true anymore, and the school district IT teams feel the consequences.

Securly has uniquely innovated to meet the new technology moment.  

The Challenge: Domain supply is effectively infinite

The proxy technologies students access are typically free, dynamic DNS services with open source frameworks that any student can copy, deploy and generate new domains on demand. So a single proxy server typically sits behind dozens of interchangeable, throwaway addresses. Block one and its replacement is already circulating. Proxy developers share working links daily and new proxy launch campaigns have their own back to school programming. 

The blocklist maintenance feels endless because it is. And the method is outdated. 

The How: Sites are built to fool outdated classification systems

The harder problem is that modern proxy technologies are engineered specifically to defeat the scanners most filtering companies use. We routinely find proxies dressed as educational content. As an example, a math curriculum site may appear to have algebra problems. However, when a student presses a certain key combination or enters a number into a calculator, it turns into a launchpad for games, unmonitored chat apps, and more. Since the site looks clean on the surface, a typical content filter’s scanner sees a harmless page, categorizes the domain as an educational resource, and moves on.

The most patient proxy developers even run dedicated campaigns designed to poison classification databases. They stand up domains with basic AI-generated content presenting a facade of an educational technology tool. They direct students to visit their content to get it seen by most content filter crawlers, then, once established and a known quantity in their proxy databases, create a subdomain or add in code to serve proxies or games. The result is a proxy that is not only unblocked, but actively endorsed by your filter’s database.

The Reporting: Your logs may not show the problem

This is the part most district leaders find unsettling. When a cloaked proxy works, your activity log shows a student on an educational site. There is no block page, no flag, and no signal that anything needs attention. A district can have a proxy problem and a clean dashboard at the same time, which means the absence of evidence in your reports is not evidence of absence on your network.

This reporting gap typically garners the standard operational answer: a queue of suspicious domains for busy staff to review and block. This only addresses the visible fraction of the problem while consuming staff hours every week, often during the busiest times of the school year. 

The Innovation: A true automated answer. We don’t pass on the burden. 

Securly Filter uniquely approaches these problems with new, next-generation engineering solutions.

Our first layer is PageScan, our proprietary, AI classification engine. When a student requests a domain that is not yet in Securly Filter’s database, PageScan evaluates it in near real time using proprietary AI techniques. This technology catches the majority of freshly created proxy domains on first contact, before the page loads.

Our second layer is our new proprietary Proxy Unmasker. It starts from the assumption that a suspicious site is hiding something, then examines it in multiple passes the way a real student would encounter it, based on analysis of hundreds of observed proxy programs. With this innovation, cloaked pages reveal themselves.

Finally, we created a unique Domain Families innovation letting us block the whole operation, including clone domains and even ones that haven’t been registered yet. Each family permutation produces a signature that strengthens Securly Filter against everything built on the same foundation.

Securly has developed even more sophisticated tools in each of these steps to combat proxies than these, but we will refrain from sharing those here. We want to ensure we keep our unmasking capabilities a mystery to proxy developers.

The Result: More accurate and automated filtering

Securly Filter is dedicated to defeating these proxy technologies without requiring additional work for your team. Unlike others, Securly doesn’t hand you recommendations; we automated the workflow. 

When a proxy is identified anywhere across the 8.6 million students Securly Filter protects, the classification propagates to every district immediately, with no list updates to apply and no queue to clear. Reclassification requests from teachers and admins are triaged by AI, with the edge cases that need human judgment typically resolved within one business day.

This is not the internet of old. It’s moving fast. Securly is innovating faster.

Want to see how Securly Filter handles the newest circumvention techniques in your environment? Register for a demo.