DNS Leak Test
On click, the browser requests one-time bash.ws test subdomains and IPOK's Worker reads the resulting resolver list. bash.ws and the relevant networks process source-network, test-ID, and DNS-request metadata.
The result identifies resolver operators and database country codes, not the visitor's real ISP or precise location. IPOK only gives a country-consistency hint when the exit and every resolver have comparable two-letter codes. A mismatch is a path clue; a match or unknown result does not prove DNS used a tunnel.