Leaks & Masking · Network Tests
Proxy & VPN Detection Test
See whether your connection looks like a proxy, VPN or hosting exit, and which signals give it away.
Looking up your address, its network, its timezone and the addresses WebRTC hands out, then comparing them against your browser.
Network identity
Signals a detection vendor would weigh
Addresses WebRTC handed out
This is a heuristic built from data your browser and connection already hand over, not a vendor blacklist or a reputation database. Datacenter keywords and timezone disagreements are useful hints and nothing more: a mobile carrier on shared address space, a corporate network or a university connection can all look the same way, and a careful residential proxy is built specifically to avoid every row below.
On this page
What makes a connection look like a VPN
No website can see your VPN client. What it sees is the address your traffic arrives from, and that address carries a surprising amount of context with it: the network that announces it, the name that network registered, the country it is registered in, and a rough idea of what kind of customer it usually serves.
A home broadband address is announced by a consumer ISP, in a block registered to that ISP, usually in the same country as the visitor. A commercial VPN exit is announced by a hosting company, in a block registered to the provider or resold to it, and its reverse DNS often points at a domain with the provider's name in it. None of that is proof, but it is easy to compute from one lookup, and it is why so many sites treat an unusual ASN as the first signal.
Counted, not convicted
Every row below is a signal that a vendor would weigh. One firing means little. Four or five agreeing starts to look unusual, which is exactly how this page scores you.
The signals sites actually weigh
The rows above cover the checks a page can run for itself, without any paid database behind them.
- The ASN and organisation. If the address is announced by a hosting provider rather than a residential ISP, that alone moves you out of the crowd. The ASN and ISP lookup shows the same values on their own.
- The name. Keywords such as hosting, cloud, colo or a VPN brand in the organisation or its domain are a crude but effective hint.
- Timezone disagreement. Your browser reports its zone from the operating system, and the IP lookup reports the zone of the address. If they differ, something is being routed.
- Clock disagreement. A timezone that was changed in the browser without touching the system clock shows up here as a non-zero difference, which is what the timezone and clock test breaks down.
- WebRTC addresses. If WebRTC reports a public address that differs from the one your HTTP requests arrive from, there is something in front of you.
Reading your result
The verdict banner is a plain summary of how many of those rows moved. A clean read — ordinary ISP naming, matching timezone, matching locale, no conflicting WebRTC address — is what an untouched home connection produces.
A datacenter verdict means several rows agreed at once. That is the signature of a VPS running a VPN, a commercial proxy, or a hosting provider's address handed to a customer. It is not a statement that you are doing anything wrong, and it is not a lookup against a list of known VPN ranges.
If WebRTC reported a public address that your HTTP requests did not come from, take that seriously. It usually means a proxy or split tunnel is in front of the browser while WebRTC escapes around it, which is the same leak the WebRTC leak test looks for.
Why this can be wrong
The honest caveat is that all of this is inference. Mobile carriers operate enormous shared address ranges that are announced much like a hosting network, and a phone on 5G can easily look like a datacenter because of it. Corporate networks, university campuses and some satellite providers announce their own ASNs too.
Timezone mismatches have innocent causes as well. People travel, work remotely, or deliberately run a clock in a different zone, and a mismatch of an hour is routine for anyone who crossed a border this week. None of that is a proxy.
What a vendor adds that this page cannot
Commercial detection also uses traffic history — how many visitors that address has served, whether it appears on abuse lists, and how many accounts were created from it. That lives on a server and in a database, so it cannot be reproduced in your browser. Treat this page as the visible half of the picture.
Making a VPN look residential
Some providers market "residential" or "dedicated" IPs, where your traffic leaves from a consumer connection rented from a real household. Those addresses survive the checks above because there is nothing unusual about them: a real ISP, a real country, a matching timezone.
What they do not fix is the mismatch signal. If you connect to a residential exit in another country and leave your browser in its home timezone, you have swapped one tell for a more obvious one. Setting the browser to match means changing the system clock or letting the browser follow the network, which some tools do automatically.
The other half of the picture is what your browser says about itself regardless of your address. The fingerprint test covers that, and the DNS leak test covers the lookups that can still travel outside the tunnel while everything else is routed correctly.