Proxy check

It’s the address websites see when you connect. At home that’s usually your router, on a phone it’s your carrier, and with a VPN or proxy it’s the server you go out through. We check over IPv4 and IPv6 separately and show IPv4 first.

They’re two separate connections, and they can leave through different networks. Plenty of VPNs and proxies only carry IPv4, so your IPv6 address can give away your real provider. If there’s no IPv6 at all, your network most likely doesn’t have it.

An IP address isn’t GPS. The location is an estimate, and the card says how sure it is: a city with the size of the area around it, a region, or only the country. Mobile and VPN addresses are often far from the person using them.

Some networks publish their own addresses. Apple lists the ones iCloud Private Relay uses, the Tor Project lists its exit relays, and cloud providers list their ranges. When your address is on one of those lists we know for sure what it is, so we mark it. The same fact appears under Already known in the fraud score block.

It’s the local time where your IP points. Your device’s own time zone is compared with it under Leaks & consistency.

The ASN is the network that routes your address, and the provider is the company that runs it. If it’s a hosting company, you’re most likely on a VPN, a proxy or a server.

How many other people checked this address here in the last 30 days and on which days, plus how busy its subnet was. A shared or resold proxy tends to show a lot. A fresh home address shows few or none. Mobile carriers share addresses between many phones, so big numbers are normal there. Your own repeat checks don’t count.

The same way websites do: your time zone with the one where your IP points, your operating system with the one your connection looks like, your DNS servers and WebRTC addresses with your IP, and how far away your browser is compared with your connection.

Whether your browser is noticeably further away than the machine that opened the connection. Without a proxy the two are about the same. With one, the browser sits an extra hop behind it, and the tile shows the gap.

Whether your browser tells the same story everywhere. Its User-Agent should be the same in JavaScript and in the request, and the encrypted connection should come from the engine it claims. We look at the engine only. Edge, Brave and Opera all run on Chromium, Firefox on Gecko, and every browser on an iPhone uses WebKit. If antivirus software or a company network opens the connection for you, we can’t tell, and the tile says Not compared.

Because language says something about you, and very little about your address. Expats, travellers and people in bilingual countries would all look wrong. We show your browser’s languages next to the ones spoken where the IP is, just for reference.

Nothing is broken. Travel, a VPN or a browser setting can all cause it. If you want to look consistent, make that tile match. Not compared means we couldn’t judge reliably, for example when the IP is only placed in a country with several time zones. A leak is more serious, because it means sites can see an address you meant to hide.

The ones that look up website names for you: your provider’s, your VPN’s, or a public one like Cloudflare or Google.

If you’re on a VPN and the server belongs to your home provider, yes. Your lookups are going around the VPN. Public resolvers like Cloudflare or Google answer from all over the world, so their location doesn’t say anything about you, and we don’t compare them.

Some resolvers pass on part of your address (EDNS Client Subnet) so websites can pick a server near you. It shows which network your lookups come from, even behind a public resolver.

WebRTC is what browsers use for calls. To get ready for one, the browser lists every address it could use. Host is a device on your own network, srflx is your public address as the internet sees it, and relay is a TURN server. Nothing is called, and your camera and microphone are never touched.

If you’re on a VPN or proxy, yes. Websites can see that address too, and it’s often your real one. Turn WebRTC off or use a browser that sends it through the proxy.

Modern browsers hide your local address behind a random .local name. Private addresses like 192.168.x.x stay inside your own network and don’t identify you online.

Then websites can’t see any addresses through it either. A few sites find a fully blocked WebRTC unusual, since ordinary browsers allow it.

They come from the start of a connection. If your browser reused an older one, there’s nothing new to show. Checking in a new tab usually fixes it.

The TCP signature belongs to whatever opened the connection. Behind a proxy or a privacy relay, that’s the relay, and it usually runs Linux, while your browser might say Windows or macOS. Websites can see the difference too.

It doesn’t prove it, but it’s a common sign. VPN tunnels add their own headers, which makes packets smaller than the usual 1500 bytes.

They’re estimates. Systems start packets at a known value like 64 or 128, and every router on the way takes one off.

No. It’s how much data the system says it can take in at once. The value helps tell systems apart.

Every system sends its options in its own order. It’s one of the best clues to which operating system opened the connection.

Two small packet details that differ between systems. On their own they say little. Together with the rest they help recognise the operating system.

No. It only shows whether your system offered congestion signalling, which is one more small difference between systems.

How your browser set up the encrypted connection. Current browsers use TLS 1.3 with HTTP/2 or HTTP/3. Anything older can mean some unusual software sits in between.

No. They’re short summaries of how a browser starts TLS (JA4), and they change with every browser version. Browser identity only looks at which engine they belong to.

Some proxies add headers like Via or X-Forwarded-For, and these can carry your real address. If you see them here, websites see them too.

Because nothing could be measured. A request was blocked, timed out or hit a busy server. A missing result isn’t a clean one. Try again, or turn off extensions that block requests.

Everything on the page as data. You get your address and its location, network and history, every leak check, the TCP, TLS and HTTP details, and each fraud score with its source once you’ve run it. It fills in as checks finish, and it includes what wasn’t found as well as what was. It contains your addresses, so have a look before you share it.

The address card is one combined answer. Fraud scores are the opposite: each one comes from a named service, as in the table above.

Yes. We keep results to count the history and to run the service. Your browser keeps one random ID, and it isn’t a cookie. The privacy notice has the details.