Proxy and VPN detector

How this test works

The detector has two modes. With the box empty it examines your own connection: the address your request came from, the headers your browser or proxy attached, and the browser-side values that the page script collects once it runs. With an address in the box it examines that address alone, using the signals that describe a network rather than a person.

Twelve signals are scored. Each one starts at a status of pass, review, fail or note, carries a point deduction, and comes with a sentence explaining the evidence. The score starts at 100 and the deductions are subtracted. The signals fall into three groups:

The network group is known as soon as the page loads. The request group is also immediate. The browser group fills in a moment later; until it does, those rows read "Not run" and the summary tells you how many of the 12 signals have been checked. The anonymity score presents the same engine as a ring with a fix list; this page is the version aimed at one question: does this connection look like a proxy or VPN?

The comparison values come from our own data. The IP's country and time zone are read from the DB-IP Lite database, refreshed monthly. The network type comes from the public routing table and our classification rules. Nothing about your browser is sent to a third party; the posted browser values are compared on our server and the comparison is returned to the page.

How to read your result

The headline is the score band: clean at 80 and above, caution from 50 to 79, risky below 50. More useful is the row-by-row view, because a proxy setup usually fails on one or two specific rows.

A VPN or proxy that is set up well fails none of these except, unavoidably, the network row when the exit is a datacenter address. That single row is why the choice of exit matters more than any browser setting: a datacenter exit costs 25 points before anything else is looked at, and a commercial VPN network costs 20 more if its name is recognizable.

Am I using a VPN? Reading the top of the page

Look at the address, the network and the location shown under the score. If the network is your own ISP and the city is yours, no tunnel is active for this browser, whatever your VPN app's icon says; apps sometimes show connected while the system routes around them. If the network is a hosting company or a VPN brand and the country is where you set the server, the VPN is carrying your web traffic. Then read the browser rows: WebRTC, DNS and IPv6 are the three ways a connected VPN still exposes your real network.

Is my VPN working? The three leak rows

• WebRTC public IP should pass or report the same address as the connection. A different public address here is your real one, reachable because the browser's WebRTC stack went around the tunnel.
• DNS resolver location should name the VPN's country or the country of the exit. Your home ISP's resolver in this row means your DNS queries bypass the tunnel, so every site name you visit is visible to the ISP, and a site that compares resolver and IP countries sees the mismatch.
• IPv6 address should say no IPv6 detected, or an IPv6 address in the same country as the exit. An IPv6 address in your real country means the tunnel carries IPv4 only.

How to fix it

Work through the rows in the order below. The first two are about the address and cannot be fixed in the browser; the rest are settings.

1. Datacenter, VPN network, Tor, DROP or blocklist rows. Change the exit. Use a residential or mobile proxy, or a VPN server that exits on a consumer network. Re-check with the IP checker until the network row passes. For a Tor exit or a DROP range there is no workaround; strict sites reject them before the page loads.
2. Time zone vs IP location. Set the clock to the exit's zone. Windows: Settings, Time and language, Date and time, switch off automatic time zone, choose the zone. macOS: System Settings, General, Date and Time, switch off automatic and pick the city. Android: Settings, System, Date and time, turn off automatic time zone. iOS: Settings, General, Date and Time, turn off Set Automatically. Antidetect browsers: set the profile's time zone to the proxy's zone, or enable the option that derives it from the proxy automatically; do not rely on the system clock.
3. WebRTC public IP. Enable the WebRTC protection in your VPN client or browser extension, or turn WebRTC off in the browser. Per-browser steps are on the WebRTC leak test page. In antidetect browsers, set WebRTC to "replace" or "altered" so the exposed address equals the proxy address, not "disabled", which is itself a rare and noticeable setting.
4. DNS resolver location. In the VPN client, enable the option that sends DNS through the tunnel or uses the provider's resolvers. For a proxy, make sure the browser is set to proxy DNS as well, for example the remote DNS option in SOCKS5 settings, and do not leave an encrypted-DNS setting in the browser pointing at a resolver in your own country. The DNS leak test shows the resolvers in use.
5. IPv6 address. Either enable IPv6 inside the VPN client, so it is tunneled too, or disable IPv6 on the network adapter while the tunnel is up. The IPv6 test has the steps for each system.
6. Proxy headers. The proxy software adds these, not the browser. Switch the proxy to elite or high-anonymity mode, or choose a provider whose proxies add no Via or X-Forwarded-For headers. Verify on the HTTP headers page, which prints every header received.
7. Browser language vs country. Add the local language of the exit's country to the browser's language list, or leave English first, which always passes this row.
8. Automation signals. Log in from a normal browser profile, not one driven by automation or started headless. If you use automation legitimately, this row will not pass, and you should not expect strict sites to pass it either.

If the account you are about to open uses two-factor authentication, have the code ready in the same profile before you log in, so you are not switching devices or windows in the middle of a challenge; a TOTP code from 2fagen.com works like any authenticator app.

Limits of this test

• Network classification is rule based. We combine a datacenter range list, keyword matching on the network name and the Tor and DROP lists. A hosting provider with a bland name may pass, and an ISP with an unlucky name may fail. The evidence is printed on each row so you can judge for yourself.
• We detect the categories we have data for. Commercial fraud databases hold lists of residential proxy pools, anonymizer ranges and addresses with abusive history that are not public. A pass here does not mean such a database has no entry for the address.
• Browser rows need JavaScript. Without it, only the network and request rows are scored and the page says so.
• The time zone rule is forgiving by design. A time zone that is used anywhere in the IP's country passes, and so does any zone with the same current offset as the IP's zone. A site may apply a stricter rule.
• The language rule is weak. Many people browse in English or in a language that is not their country's main one. We deduct only 5 points, and we state that it is a weak signal.
• Checks of a third-party address cover network signals only. Time zone, WebRTC, DNS, IPv6, headers and automation describe a browser session, and we do not have that session for an address you typed in.
• No test proves anonymity. The score describes how your connection looks against 12 published checks. It is not a guarantee about any specific site, and it says nothing about accounts, cookies or payment data that identify you independently of the address.

How websites detect proxies and VPNs

Most detection is done with the same public facts you see on this page. The network that announces an address is public, and so are lists of datacenter ranges, Tor exits and the address blocks that VPN providers rent. An address on a hosting network is treated as a server by default, because few real visitors browse from a datacenter. Headers are the next clue: a transparent proxy adds X-Forwarded-For with your real address, and many proxies add Via, both of which a site reads in the same request that carries your login.

After that come consistency checks between the address and the browser. The browser's time zone is readable by any script, and so is its language list; a site compares both with the IP's country. WebRTC can reveal a public address outside the tunnel. A DNS leak is visible to sites that run their own authoritative name servers, exactly the way our DNS leak test does it. Some sites go further with signals we do not reproduce here: the latency between the browser and the server compared with what the IP's distance implies, the TCP and TLS characteristics of the connection, which differ between a phone and a VPN gateway, and a history of how many distinct accounts have appeared from the same address. The vpn detection glossary entry goes into each method.

Residential, mobile and datacenter exits

The network row is decided by which of these your exit is, so it is worth knowing the difference. A datacenter IP belongs to a hosting company; it is cheap, fast and stable, and it is also the easiest to flag, because the network exists to host servers. A residential IP is assigned by a consumer ISP to a home line; a residential proxy exits through such a line and inherits its reputation, which is good until too many customers share it. A mobile IP belongs to a carrier and is shared by many phones behind carrier-grade NAT, which is why sites are reluctant to block one: blocking it would block thousands of real customers. For logins to strict services, mobile and residential exits in the account's own country are the only choices that pass the network row, and the rest of this page is about not wasting that advantage with a leak.

Transparent, anonymous and elite proxies

These are old labels, but the header behavior they describe is still what sites read. A transparent proxy passes your real address along in X-Forwarded-For or Forwarded; the destination sees both the proxy and you. An anonymous proxy strips your address but adds a Via header or similar, so the destination knows a proxy is involved without knowing who is behind it. An elite proxy adds nothing, and the destination sees an ordinary request from the proxy's address. The proxy headers row distinguishes the three for your current connection, and the HTTP headers page shows the raw values. Note that a residential proxy can still be transparent: the network type and the header behavior are independent, and you need both to be right.

Checking a proxy before you buy or use it

Enter the proxy's exit address in the box to see the 5 network signals without routing anything through it. Then route this browser through the proxy and reload with the box empty, so the request and browser rows are scored too. The two results together tell you whether the address is acceptable and whether your configuration of it is clean. Repeat the second check whenever you change a profile, a proxy port or a VPN server; the browser rows change with every such change, and the whole check takes a few seconds.