CHECK

Environment Check

Checks exit network, leaks, timezone and language, browser identity and device fingerprint in one run, cross-checking your exit IP against browser and system to find what risk engines flag.

Ready

The check runs in your browser and usually finishes within 10 seconds. It only reads public network and browser characteristics — never accounts, passwords, cookies, forms or local files.

CleanIP Score

…

Type and reputation of the exit IP itself, same as the homepage

Consistency

—

Whether browser, system and network agree with each other

—Problem

—Attention

—Pass

Exit networkPending
LeaksPending
Timezone & languagePending
Browser identityPending
Device fingerprintPending
Service reachabilityPending

Exit IP summary

Identifying your exit IP

Check details

26 checks

Exit network

Whether endpoints see the same exit, whether IPv6 exits elsewhere, whether requests carry proxy headers

Websites see your exit. Different sites seeing different exits, IPv4 and IPv6 in two places, or headers exposing a proxy chain all make one person look like several.

Exit consistency across endpointsReads the exit IP from this site, IPv4 / IPv6 echo endpoints and Cloudflare at the same time and compares them
IPv6 exitCompares the country, network and network type of the IPv4 and IPv6 exits to see whether IPv6 bypasses the proxy
Proxy headersChecks whether requests carry Via, Forwarded or similar headers added by HTTP proxies

Leaks

Whether WebRTC exposes your real address around the proxy, and which resolvers send your DNS queries

A leak bypasses the proxy and hands your real address or ISP to websites — the most direct evidence for flagging an environment or linking accounts.

WebRTC address leakGets the public address WebRTC actually uses via STUN and compares it by candidate type with the web exit of the same family (IPv6 by /64)
DNS resolution pathMakes the browser resolve and fetch one-time domains; this site's authoritative DNS records which resolvers actually asked, and their location and network type are compared with your exit

Timezone & language

Whether system timezone and browser language match the exit location, and whether either was only half changed

Timezone and language that do not match the IP location are the most common signal for proxy use; a half-changed timezone or language proves the environment was altered.

System timezone ↔ exit timezoneCompares the UTC offset and country of the system timezone with those of the exit location
Timezone self-consistencyCompares the Date object's UTC offset with the timezone reported by Intl to find a half-changed timezone
Browser language ↔ exit countryChecks whether the browser's preferred language is commonly used in the exit country
Accept-Language ↔ navigator.languagesCompares the language declared in the HTTP header with the one JavaScript reads

Browser identity

Whether the UA agrees with the JS engine, version, platform, Client Hints and HTTP headers, and whether automation traces exist

The UA is the easiest field to change, but the engine, platform and Client Hints are hard to change consistently. Contradictions get flagged as tampering or automation.

UA ↔ JavaScript engineIdentifies the real JS engine from its engine-specific error messages and compares it with the browser the UA claims
UA version ↔ engine capabilityInfers the real version range from supported JavaScript features and compares it with the UA version
UA OS ↔ navigator.platformCompares the operating system in the UA with the platform the browser reports
UA ↔ Client HintsChromium reports brand, version and platform separately through Client Hints; compares them with the UA string
HTTP UA ↔ JavaScript UACompares the User-Agent our server received with navigator.userAgent in the page
Automation tracesLooks for the WebDriver flag, headless browser UAs and variables injected by Selenium, Playwright and similar frameworks
Main thread ↔ WorkerReads UA, platform, languages, timezone and hardware values in a separate Worker and compares them with the page
Native APIsChecks whether UA, platform, language, timezone and Canvas / WebGL / Audio APIs are still the browser's native implementations
WebRTC APIChromium cannot turn WebRTC off in settings; checks whether RTCPeerConnection has been removed

Device fingerprint

Whether the GPU contradicts the system, whether Canvas / Audio carry injected noise, whether fonts and touch fit the claimed device

Device fingerprints answer "is this the same device?". A fingerprint that contradicts the claimed system, or changes on every read, shows it has been modified.

GPU ↔ operating systemChecks whether the WebGL renderer belongs to the claimed OS and whether it is software rendering without a real GPU
Canvas fingerprint stabilityDraws the same image twice and reads back a solid-color area to detect injected random noise
Audio fingerprint stabilityRenders the same signal twice in an offline audio context and compares the results
Fonts ↔ operating systemDetects fonts preinstalled by each OS to see whether they fit the desktop OS the UA claims
Touch ↔ device typeA mobile UA should come with touch support

Service reachability

Whether common AI, streaming and web services connect, and how fast — for reference only, not scored

This only shows whether a service connects and its latency. It says nothing about sign-up eligibility or content unlocking, and does not affect the consistency score.

AI servicesChatGPT, Claude, Gemini, Perplexity, Copilot
Streaming & socialNetflix, YouTube, Disney+, Prime Video, Spotify, TikTok
Common sitesGoogle, X, GitHub, Cloudflare

Next steps

Risk engines judge a visit by more than its IP — they check whether the IP, system and browser fit together. This page cross-checks exit network, leaks, timezone and language, browser identity, device fingerprint and service reachability in one run. Contradictions that only show up in combination — a German IP with a Beijing timezone, a UA claiming Windows with only macOS fonts — are pointed out here.

Two scores and the result levels

The CleanIP Score rates the exit IP itself — type, reputation and blocklists — the same as the homepage. Consistency rates whether this run's checks agree, starting from 100; nothing is counted twice. Each check lands in one of three levels:

Problem: hard evidence such as a real-address leak, a UA contradicting the engine or platform, a half-changed timezone or automation traces. Costs 30 points and caps the score at 69.
Attention: mismatches risk engines weigh but that may be legitimate, such as a timezone not matching the exit or IPv6 exiting elsewhere. Costs 12 points; first ask whether it is intentional.
Minor: low-weight notes, such as a browser language not common in the exit country. Costs 4 points.

When to run a check

After changing your proxy, VPN node or antidetect browser profile
Before signing up or signing in to cross-border e-commerce, ads, payment or AI platforms
After an account is flagged, challenged or linked, to find which layer gave it away
Periodically during long-term use — proxy exit quality and routing change over time

Common questions7

Does the check collect or store my information?

Fingerprint, timezone and language traits are computed locally in your browser and raw fingerprints are not uploaded. Network lookups for your exits and resolvers, the DNS probe and the header echo go through our servers and are used only for this check; nothing scans your device or ports. You export the report yourself; we never tie it to an identity.

Why is consistency so different from the CleanIP Score?

They measure different things. A clean residential IP with a contradictory timezone can have a high CleanIP Score but lose consistency points; a datacenter IP can still score 100 on consistency if browser, system and exit agree.

Are IPv4 and IPv6 in different regions always a leak?

No. Attention is raised only when the two families are on different networks and in different countries, which usually means the proxy only handles IPv4. Same network with different registered countries is most likely an IPv6 geolocation discrepancy.

WebRTC shows my LAN address — is that a problem?

LAN addresses (such as 192.168.x.x) reveal your local network layout, not your identity, so they are only Minor. Proxy / VPN virtual adapter addresses such as 198.18.x.x or 10.8.0.x show that TUN or a VPN is running, so they need attention. The real risk is WebRTC exposing a public address different from your exit, meaning UDP traffic bypasses the proxy.

Why does DNS say no queries were captured?

The check makes the browser resolve and request a set of one-time hostnames. Whether resolution happens on your machine, in the proxy client or on the proxy server, the query reaches our authoritative DNS — with DoH too, where we see the DoH provider. Queries are missed only when a DNS filter (such as an ad-blocking DNS) or a network policy blocks the probe hostnames; no verdict is given then.

Is random noise in my Canvas fingerprint good or bad?

Noise stops sites from tracking you long-term, but a value that changes on every read is easy to recognize, and platforms take it as a sign of anti-fingerprinting tools. When you need a stable identity (e.g. running several accounts), use a per-session fixed approach rather than per-read randomness.

If everything passes, will I never be flagged?

No. This checks whether your network and browser environment is self-consistent; platforms also weigh account history, sign-in behavior, payment details and long-term device records. Passing everything means the environment itself shows no obvious gaps; IP reputation is covered by the CleanIP Score.