Is ping0.cc safe? We tested it — it collects your real IP
If you use ping0.cc to check a proxy / VPS / server IP, be careful: a live packet capture shows it also quietly collects your machine's real IP — a real de-anonymization risk if you care about privacy.
Three moves: (1) its front-end check.js uses WebRTC (RTCPeerConnection + STUN) to pull your real IP behind the proxy out of the ICE candidate, then POSTs it to /ip/peer; (2) it loads scripts from both ipv4.ping0.cc and ipv6.ping0.cc to force your browser onto each protocol and capture both your IPv4 and IPv6; (3) it then sends /logv6/{your-IPv6}/{your-IPv4}, pairing your real IPv4 and IPv6 and logging them to its servers.
Reproduce it in 30 seconds: open ping0.cc, press F12 → Network, refresh, and search for peer, logv6, ipv4.ping0 — all three are there. Open the logv6 request and your IPv4/IPv6 pair is right in the URL.
IPOK is the alternative that doesn't do this: the WebRTC leak test runs only on click, entirely in your browser, and is never sent to us; there's no forced IPv4/IPv6 capture and no IP-pairing log; queries are stateless, with no database, no analytics, and no tracking cookies. Check any IP with it below — we check IPs, not you.