Is ping0.cc safe? We tested it — it collects your real IP

For years ping0.cc has been treated as the default tool for checking IP purity, but since 2024 communities like LINUX DO and NodeLoc have dissected its page behavior. The moment its checker loads, your browser fires off WebRTC ICE candidate gathering in the background — essentially asking a STUN server "what is my public address?" The catch is that WebRTC reports your device's own network egress, not the egress of your proxy or VPN. So even when you browse through a proxy, this step can surface the real residential IP sitting behind it.

What makes it worse is where the data goes. Community reverse-engineering found the relevant scripts are obfuscated, and the WebRTC results are sent back to the server rather than computed locally and discarded. Pair the proxy exit IP seen in the HTTP request with the real IP grabbed via WebRTC, and the server now has exactly the raw material needed to link a proxy node to the real user behind it. For cross-border sellers, multi-account operators, and anyone using a proxy specifically to protect their identity, this is the worst-case outcome.

There is also a frequently cited side effect: community observers note that ping0's "risk value" counts every visit toward that IP's "shared user count." So repeatedly refreshing your own lookup pushes the shared count up and inflates the risk score. In other words, the more you use it to check an IP, the worse the verdict it may return — the opposite of what you expect from a neutral diagnostic tool.

Privacy-first is an engineering stance, not a tagline, and it comes down to a few deliberate choices. The first: browser-side WebRTC and DNS leak detection should help you audit yourself, not quietly harvest data for someone else. The IPOK checker above this article also runs WebRTC and DNS leak tests, but the purpose is to tell you whether your current proxy setup is leaking your real IP. The result is shown on your own screen, and as an independent developer I don't write any detected real IP into a profile or database.

The second: separate the thing being queried from the thing being collected. The ping0 problem is that "the IP you look up" and "the you it secretly records" get merged into one dataset. IPOK's stance is the opposite — the IP you submit for a risk check is not persisted long term, and the detection logic runs then discards. You want to know whether a node is clean, not to hand yourself over in the process.

The third: show the evidence instead of a black-box number. ping0's risk value is influenced by metrics like "shared user count" that the act of visiting itself pollutes, so it's hard to interpret. IPOK aggregates 8 risk sources (ip-api, ipapi.is, proxycheck, AbuseIPDB, Scamalytics, StopForumSpam, IPQS, plus the in-house IPOK-DB covering Tor exits, X4BNet, Spamhaus and similar lists) and applies a floor to hard signals — if an IP hits an authoritative blocklist or is confirmed datacenter, that verdict won't be diluted by optimistic scores from other sources. Every judgment maps back to which source produced it and what it concluded.

ping0 popularized the term "native IP" in Chinese-speaking circles, but many people remember the conclusion without understanding the mechanism. A native IP is one whose registered country, actual route announcement, and assignment by a genuine local ISP all line up — as opposed to a datacenter IP that merely "relabels" its location via a GeoIP database to pretend it belongs to some country. Services like ChatGPT, Netflix, and bank risk engines are highly sensitive to this; a datacenter (hosting) IP often gets flagged high-risk even when its geolocation tag is correct.

Deciding native versus datacenter isn't done from a single field. It takes cross-validation across ASN type, reverse DNS, the IP block's registered usage (whois/RIR data), and whether it falls inside known hosting ranges. IPOK weighs these signals together when classifying native vs datacenter, rather than trusting one GeoIP database's word — single databases routinely mislabel residential IPs as datacenter, or tag a datacenter as residential in some country.

The /24 neighbor (C-block) profile is another overlooked but practical dimension. Whether an IP is clean depends heavily on what its neighbors are doing: if a large share of addresses in the same /24 are flagged as proxies, spam sources, or blocklist hits, then even if your specific IP is momentarily clean, it lives in a bad neighborhood and is more likely to be blocked by association. IPOK scans the overall risk distribution of the IP's /24 block so you can spot a burned-out range before you pick a node or buy a proxy.

If you're just curious about your home connection's location, the choice of tool barely matters. But several groups should take the checker's own privacy behavior seriously. Cross-border sellers and multi-account operators: your biggest fear is having the real egress behind different accounts correlated, and a checker page that grabs your real IP via WebRTC could be one link in that correlation chain. People doing due diligence before buying a proxy or VPN: you want to verify whether a node is native and clean — there's no reason to leak your own real IP to a third party while doing it.

Developers and fraud-prevention practitioners: you need explainable, integratable verdicts, not a black-box score that drifts with visit count. IPOK ships a bilingual (Chinese/English) interface; the hard-signal floor and the 8-source breakdown make conclusions reviewable, and the C-block profile and native classification feed directly into sourcing, node selection, or risk-rule decisions.

The workflow is simple: drop the IP you want to check into the detector above, and it returns an aggregated risk verdict, a native/datacenter classification, and a /24 neighbor overview. To confirm whether your current proxy is leaking, run the page's WebRTC/DNS leak test — the difference being that this time the real IP it surfaces belongs only to you, is shown once, and isn't filed into anyone's records.