A 407 comes from the proxy: it refused the connection, for example over the password, username or targeting options. A 403 or 429 that arrives after the tunnel opens comes from the website. A 502 or 503 from the proxy means it could not open the connection.