Proxy Anonymity Test: VPN Leak & Privacy Checker

Because the two statements come from different layers, and only one of them can be faked from inside a browser. Your User-Agent is a text string that any browser or extension can rewrite. The TCP SYN packet that opens the connection is built by the operating system kernel, and its option ordering, window scale and timestamp behaviour differ between Linux, Windows and Apple systems. Apple devices send TCP options in the order MSS, NOP, WS, NOP, NOP, TS, SACK_PERM, EOL. Linux sends MSS, SACK_PERM, TS, NOP, WS. If your browser claims iOS but the kernel signature is Linux, the TCP connection reaching us was not opened by your phone. It was rebuilt by another machine, almost always a proxy server or a CDN edge node.

💡 Check your device hardware, Canvas, and WebGL consistency with our Browser Fingerprint Test.

The maximum segment size advertised in your SYN packet lets us work backwards to the path MTU: MTU equals MSS plus 40 bytes on IPv4 and plus 60 bytes on IPv6. Different link types have distinctive values. Home broadband over PPPoE is 1492. Mobile carriers usually land between 1400 and 1430. WireGuard tunnels default to 1420. Bare Ethernet, which in practice means a machine sitting in a data centre, is 1500. A phone reporting 1500 is therefore a contradiction worth reporting: no cellular link delivers that value. On a desktop the same number proves much less, because office LANs and fibre connections without PPPoE also reach 1500, so we weight it far lower.

💡 If you suspect abnormal proxy routing rules, test multiple endpoints with our Split Tunneling & Route Leak Test.

Because IP reputation and protocol behaviour are independent. Buying a residential IP changes what databases say about your address, but it does not change how the exit machine builds packets. If that machine is a Linux server, it still sends Linux TCP options, still advertises a data centre MTU, and still terminates TLS with its own fingerprint. A risk system that looks only at IP lists will see a clean residential address. A system that reads the protocol stack sees a server. This is the single most common blind spot we find, and it is why the report separates evidence that is proven from the protocol from evidence that merely comes from address reputation.

💡 Look up full ASN details and fraud risk scores on the MyIPDNS Homepage.

It means we could not find a contradiction in the protocol layers and are relying on what address databases say about your exit. This happens when your own device and the proxy server run the same operating system family. A Linux desktop behind a Linux proxy produces one consistent Linux signature, so cross-layer analysis has nothing to compare. We label the verdict honestly instead of hiding the weakness: evidence tagged as protocol was proven from packets, evidence tagged as reputation was not. A low confidence verdict built only on reputation should be read as a hint, not as proof.

💡 Developers can query structured ASN and risk scoring data programmatically via our Free IP API.

Some signals are configuration and some are physics. A data centre MTU can be hidden by setting the tunnel interface MTU on your server to a value between 1420 and 1450, which makes the path look like a consumer tunnel. Shared TCP timestamp offsets disappear when the exit host runs a kernel that re-rolls the offset for every connection rather than hashing it per address pair. A mismatch between the exit operating system and the one your browser claims cannot be fixed by client settings at all: it goes away only if the exit host runs the same system family, or if SYN options are rewritten at the exit. No browser extension can change any of this, because none of it is generated by the browser.

💡 After tweaking your network settings, return to the Homepage to re-run full connectivity and stack tests.

No. Everything described here is inferred from the packets that actually reach our probes, which carry your exit address and nothing else. We can often tell that a connection was rebuilt somewhere along the way, and we can describe the properties of the machine that rebuilt it, but the address of the device that originally opened the session is not present in that traffic and cannot be recovered from it. Separately, WebRTC and DNS checks on this site can reveal a local address if your browser or resolver leaks one, which is a different mechanism and is reported separately.

💡 To diagnose multi-probe routing and DNS divergence, consult our Route Leak Diagnostics.