Glossary

Anonymity scoreAn anonymity score summarizes how much a connection looks like a real, direct user. Ours deducts fixed points per signal and explains each o ASN (Autonomous System Number)An ASN identifies an autonomous system: a network, such as an ISP or hosting company, that announces its own IP ranges to the internet. Browser fingerprintA browser fingerprint is the combination of browser and device traits a website can read and use to recognize you without cookies. Canvas fingerprintA canvas fingerprint is a hash of how your browser draws hidden graphics; small rendering differences make it a stable device identifier. CIDR notationCIDR notation writes an IP range as an address plus a prefix length, such as 192.0.2.0/24, where the number tells how many leading bits are Client hintsClient hints are HTTP headers and a JavaScript API that replace parts of the user agent string with structured details about the browser and Datacenter IPA datacenter IP belongs to a hosting or cloud provider rather than an ISP. Sites often treat it as a server, proxy, or VPN and apply extra c DKIMDKIM signs outgoing email with a private key; the public key in DNS lets receivers verify the message was not altered or forged. DMARCDMARC is a DNS policy that tells receivers what to do when SPF or DKIM fails for a domain and where to send reports about it. DNS leakA DNS leak happens when your DNS queries bypass your VPN or proxy and reach a resolver that reveals your real ISP or location. DNSBL (DNS blocklist)A DNSBL is a blocklist queried over DNS. Mail servers and websites use it to check whether an IP has a history of spam, abuse, or malware. ICMPICMP is the control protocol of the internet. Ping and traceroute use its echo and time-exceeded messages to test reachability and routes. IP addressAn IP address is the numeric label that identifies a device or network on the internet so that data can be routed to and from it. IP geolocationIP geolocation estimates where an IP address is used, based on registry data and network measurements. It is accurate to the country, less s IPv4IPv4 is the fourth version of the Internet Protocol, using 32-bit addresses written as four numbers from 0 to 255, such as 203.0.113.7. IPv6IPv6 is the current version of the Internet Protocol, with 128-bit addresses written in hexadecimal, such as 2001:db8::1. IPv6 leakAn IPv6 leak occurs when a VPN or proxy tunnels only IPv4 traffic, so websites can still reach you over your real IPv6 address. JitterJitter is the variation in latency between consecutive packets. High jitter hurts calls and games even when the average ping looks fine. Language mismatchA language mismatch is when your browser's preferred languages do not fit the country of your IP address, a weak but visible proxy signal. LatencyLatency is the time a packet needs to travel to a destination and back, usually measured in milliseconds with ping. mDNSmDNS is a local-network name protocol. Browsers use mDNS names like xxxx.local to hide your private IP in WebRTC candidates. Mobile IPA mobile IP is an address from a cellular carrier. Thousands of phones often share one address through carrier NAT, so blocking it is costly MX recordAn MX record tells sending mail servers which hosts accept email for a domain, with a priority number for each one. NAT (network address translation)NAT lets many devices share one public IP address by rewriting packet addresses at the router; it is why your local IP differs from your pub OUI (MAC address prefix)The OUI is the first three bytes of a MAC address, assigned by the IEEE to a manufacturer, so it reveals who made a network interface. Proxy headersProxy headers such as Via and X-Forwarded-For are added by some proxies and can reveal to websites that a request did not come directly from PTR record (reverse DNS)A PTR record maps an IP address back to a hostname. It is the DNS record behind reverse DNS lookups and is often checked by mail servers. RDAPRDAP is the JSON-based successor to WHOIS. It returns registration data for IP ranges, ASNs, and domains from the registries themselves. Residential IPA residential IP is an address assigned by a consumer ISP to a home connection. Websites treat it as a strong sign of a real person. SPFSPF is a DNS TXT record that lists which servers may send email for a domain. Receivers use it to reject forged sender addresses. STUNSTUN is the protocol WebRTC uses to discover your public IP and port through NAT. It is the mechanism behind most WebRTC IP leaks. Subnet maskA subnet mask separates the network part of an IPv4 address from the host part; 255.255.255.0 is the same thing as a /24 prefix. Timezone mismatchA timezone mismatch is when your browser's clock zone differs from the zone of your IP's location, a common sign of a proxy or VPN. Tor exit nodeA Tor exit node is the last relay in a Tor circuit; websites see its IP instead of yours, and most of them can recognize it from public list TracerouteTraceroute lists the routers a packet passes on the way to a destination, with the delay at each hop, by sending probes with rising TTL valu TTL (time to live)TTL is the number of seconds a DNS record may be cached, or the hop limit on an IP packet that traceroute uses to map a route. User agentThe user agent is the string your browser sends to identify itself, its version, and the operating system; sites parse it before anything el VPN detectionVPN detection is how websites identify traffic from VPN and proxy services, using IP ownership data, blocklists, and browser consistency che WebRTC leakA WebRTC leak exposes your real public or local IP address through the browser's WebRTC APIs even while a proxy or VPN is active. WHOISWHOIS is the protocol and the records that show who registered an IP range, an ASN, or a domain, including contacts and dates.