IP Leak Test

A proxy or VPN only takes over one path: the HTTP/HTTPS traffic your browser actively sends. The trouble is your device has more than one way to reveal its real identity — at least three independent channels bypass the tunnel: WebRTC, DNS, and IPv6. They're independent of each other, so closing one says nothing about the other two. That's exactly why an IP-leak check has to test all of them together rather than just one.

WebRTC is the browser's built-in peer-to-peer capability (video calls and screen sharing rely on it). To punch through NAT it queries a STUN server and gets back a 'server-reflexive candidate' — your machine's real public exit IP. This exchange ignores your HTTP proxy settings, so a few lines of RTCPeerConnection script can read the real address behind your proxy without you ever noticing. Modern Chrome / Edge now obfuscate local-network IPs into .local hostnames via mDNS, but that only hides private addresses — the public reflexive address, the one that actually matters, can still leak.

A DNS leak is a different beast. Even when your web traffic goes through the proxy, the 'ask for directions' requests that translate domain names into IPs (DNS queries) may not follow it into the tunnel, landing instead at your local ISP's resolver. Through EDNS or resolver ownership, a site can infer your real carrier and rough region — the IP looks like the proxy's, but DNS gives you away.

IPv6 leaks are the sneakiest. Today's home broadband and 4G/5G are mostly dual-stack (both an IPv4 and an IPv6 exit), yet many proxy clients tunnel only IPv4 by default, assuming you have no IPv6. The result: IPv4 dutifully goes through the tunnel while IPv6 goes straight out over your real line. Operating systems also tend to prefer IPv6 (lower latency), so plenty of requests take the un-proxied path.

For anti-fraud and platform risk teams, a lone proxy IP is of limited value — the real damage comes from correlation. When one page captures both your proxy exit IP and a real address leaked through any channel (a WebRTC reflexive IP, a DNS resolver's location, or an un-proxied IPv6), it can bind your 'disguised identity' to your 'real identity.' Multiple buyer accounts in cross-border e-commerce, multi-account ad arbitrage, bulk sign-ups for promo abuse — these often get caught precisely by this v4/v6 pairing or WebRTC reflection being flagged as the same device.

One common and fatal combination: your proxy hands you a clean residential IPv4, but your IPv6 is your real home address. The risk-control site records both; the next time it sees that same IPv6 on a different 'clean' account, the two accounts are instantly strung together. You thought you'd switched IPs — but that unattended IPv6 has been acting as your ID card the whole time.

For VPN / proxy users this means 'connected' does not equal 'anonymous.' The test of whether anonymity holds isn't that the main IP shows the proxy — it's whether any of the three channels leaked a real location inconsistent with your exit. One inconsistency, and the anonymity chain is broken.

The logic of a combined check is: first confirm your public exit IP (is the proxy actually in effect), then verify whether each side channel leaks an address inconsistent with that exit. This page's detector folds these steps into a single scan — exit IP, whether WebRTC exposes a mismatched real IP, whether the DNS resolver's location matches the exit region, and whether your IPv4/IPv6 dual-stack exits agree. What matters isn't 'did an IP leak' but 'does the leaked one line up with your proxy exit.'

Fixing WebRTC: in Firefox, open about:config and set media.peerconnection.enabled to false to turn it off completely; Chrome / Edge have no native switch, so you'll need a WebRTC-control extension or an enterprise policy. Note that if you rely on in-browser video calls, disabling WebRTC breaks those too — trade off as needed.

Fixing DNS: enable 'DNS over the tunnel / DNS leak protection' in your proxy / VPN client (almost all mainstream clients have it), or point your system DNS at a trusted resolver (e.g. 1.1.1.1). Always re-test here afterward to confirm the resolver's location now matches your proxy exit region.

Fixing IPv6 has two routes: either disable IPv6 outright in your OS network settings or router (the cleanest fix — afterward the IPv6 exit on this page shows unreachable), or switch to a tool that explicitly proxies both v4 and v6. Re-run the full scan after all three fixes — only when every channel agrees with your exit are you truly anonymous.

IPOK is an IP purity / risk-score checker built by an independent developer, with this combined leak check folded into a single page: you see your exit IP, whether WebRTC leaks a mismatched real identity, your DNS resolver's location, and dual-stack consistency at once — judged with the same logic risk controls use, so you can spot where the anonymity chain breaks.

The key difference is the privacy stance. Some IP-check sites actively use WebRTC to pierce the real IP behind your proxy and send it back to their servers, and even log your IPv4/IPv6 pair into a backend record — those sites are themselves de-anonymization tools. IPOK does the opposite: the WebRTC test runs only on click, entirely in your browser, and is never sent back to us; no IP-pairing log; queries are stateless, with no database, no analytics, no tracking cookies. We check IPs, not you.

So run this page before you 'rely on anonymity' — before opening a new account, after switching proxy environments, or simply to know whether you're leaking at all. Use the detector below to see whether all three channels are clean.