What Is VPN Tracing? How Do You Prevent Being Tracked?

Introduction: Why a VPN Isn't a "Get Out of Jail Free Card"

The typical assumption goes: install NordVPN / Surfshark / a self-hosted WireGuard, change your exit IP, and "nobody can tell who you are anymore." That's a 2010s mindset. Tracking technology has long since moved past the "IP layer":

• Detecting that "you're using a VPN" is a basic risk-control capability (checking whether the IP belongs to a VPN provider's ASN — nearly all commercial VPN datacenter ranges are already flagged)
• Identifying "your previous real IP" only needs the IP layer — WebRTC / IPv6 / DNS leaks / CDN origin bypass — and a single slip-up gets you permanently tagged with a cookie
• Identifying "exactly which person you are" doesn't rely on IP at all — it relies on browser fingerprinting, behavioral patterns, and cross-account correlation
• In extreme cases, legal assistance (subpoenas / cross-border investigations) can force VPN providers to hand over logs

In other words, what tracks you isn't a single vulnerability — it's the intersection of N dimensions — you have to defend every single one, while the tracker only needs to succeed on any one of them. That's why "complete anonymity" is nearly impossible from an engineering standpoint, but "significantly reducing correlation" is achievable — this article shows you how.

① IP-Layer Leaks — Your Real IP Exposed Directly

The most classic and most common case. A VPN only takes over the browser's HTTP / TCP traffic, but the following channels can bypass the VPN entirely and hand your home public IP straight to the other side:

1.1 WebRTC Leaks

The browser's built-in WebRTC (used for video calls) actively uses the STUN protocol to discover the public IP it sees, and JavaScript can read that value directly. HTTP / SOCKS proxies only intercept TCP, while STUN runs over UDP, bypassing the proxy entirely through your home network adapter and exposing your real IP.

Defense: Use a TUN-mode VPN (Mihomo / Clash Premium / WireGuard TUN / Tailscale), which takes over all TCP+UDP traffic on the virtual network adapter; or disable WebRTC in the browser: in Firefox, go to about:config → media.peerconnection.enabled = false; in Brave, enable "Disable Non-Proxied UDP"; in Chrome, install uBlock Origin to block WebRTC.

Try it: Use our /leak leak detector to check whether the public IP returned by WebRTC STUN matches your HTTP exit.

1.2 IPv6 Dual-Stack Leaks

Your VPN only proxies IPv4, but your home broadband also has IPv6 — the browser prefers to go out over IPv6, completely bypassing the VPN. This is an extremely common vulnerability for China Telecom home broadband users.

Defense: Either use a VPN that proxies both IPv4 and IPv6, or disable IPv6 at the system / browser level. On Windows, edit the registry; on macOS, use networksetup.

1.3 DNS Leaks (covered separately, see ② DNS Layer)

1.4 CDN Origin Bypass

If a site uses a CDN like Cloudflare, you're actually hitting a CDN edge-node IP — but if an attacker obtains the site'sreal origin-server IP, they can bypass the CDN and access it directly. The reverse also holds true for trackers: if the CDN node you hit is in China, but some static asset in the same session is fetched directly from the origin (not covered by the CDN), your real IP ends up in the origin server's access logs.

Defense: This edge case mainly depends on the target site's own configuration being strict — there's limited a user can do on their end.

② DNS-Layer Leaks — Which Domains You Query Expose Your Identity

Your IP traffic goes through the VPN, but DNS queries may still go through your local ISP. There are two ways this leaks:

2.1 Resolver Country Mismatch

Your VPN exit is in the Netherlands, but when your system makes DNS queries, the stub resolver usesthe DNS configured by your home broadband provider (China Telecom). When the authoritative nameserver receives the query, it sees a source IP from China Telecom — revealing your real location to the operators behind every domain you visit.

2.2 ECS Subnet Leaks

Public recursive resolvers (Google's 8.8.8.8 has EDNS Client Subnet enabled by default) forwardyour real /24 subnetto the target authoritative server for "location-based CDN routing." But in that moment, your subnet has been disclosed to the remote authority — more precise than the resolver's exit IP, pinpointing the subnet of your own neighborhood.

Defense:

• Force your VPN client to use a custom DNS — use the VPN provider's own DNS (NordVPN / Mullvad / ProtonVPN all offer one)
• Don't let DNS queries leak outside the tunnel — the resolver would then see your real IP, which won't match your web traffic and gives you away instantly. Note that 1.1.1.1 / 8.8.8.8 are anycast: as long as the query goes through the tunnel it lands near your VPN exit and reveals nothing. The real problem is the system bypassing the tunnel to reach them directly
• If you do choose a public recursive resolver, at minimum make sure it's in the same country as your VPN exit
• Use DoH (DNS-over-HTTPS) to force-encrypt DNS queries and prevent ISP man-in-the-middle inspection

Try it: Our /leak DNS leak detector runs its own authoritative nameserver, actually routing your browser's queries to our server so you can see the resolver IP + ECS subnet. For the full mechanics, see the complete guide to public DNS resolvers.

③ TLS Fingerprinting (ja3 / ja4) — Who Is Your Client

During the HTTPS handshake, the client sends a ClientHello packet to the server, listing the TLS versions, cipher suites, extensions, elliptic curves, and more that it supports. The exact order and content of these fields differ across every client(Chrome 124 vs Firefox 123 vs curl vs Python requests), and the resulting combined fingerprint is what's known industry-wide as ja3 / ja4.

Sites can record every visitor's ja3 / ja4 fingerprint and compare it against the User-Agent — if your UA claims to be Chrome 124 but your ja3 fingerprint matches Python requests, that's bot or scripted traffic. This is also one of the core signals used by anti-bot services like Cloudflare and Akamai.

Defense:

• Use a genuine mainstream browser (Chrome / Firefox / Edge) — don't run Selenium / Puppeteer bare, their ja3 fingerprints are extremely distinctive
• When automation is needed, use undetected-chromedriver / Playwright + curl-impersonate
• Don't install "anti-fingerprint" browser extensions — it actually makes your ja3 more distinctive than a normal Chrome, effectively flagging yourself as someone running anti-tracking tools

④ HTTP / Browser Fingerprinting — Canvas / WebGL / Fonts / Timezone

Fingerprints exposed at the application layer are richer, and harder to defend against:

Key pitfall: Having your timezone / language / fonts not match your VPN exit country is an extremely strong "using a VPN" signal. Your VPN hops to the US, but the browser's timezone is still Asia/Shanghai and the language is zh-CN — instantly obvious.

Defense:

• "Look ordinary" — don't install anti-fingerprint extensions in your browser, that itself is abnormal. An ordinary user's plain Chrome fingerprint is the best disguise.
• Separate use cases: use your main browser for your real identity, and a separate browser profile / VM / Tails / Whonix for privacy-sensitive activity
• Keep your VPN exit country, system timezone, and browser language all consistent — at minimum, don't leak the giveaway signal "I'm a Chinese user routed through a US VPN"
• The Tor Browser was designed specifically for this — every user looks identical, at the cost of performance

Try it: Use our /fingerprint browser fingerprint checker to see the uniqueness of your own 14 fingerprint dimensions.

⑤ TCP/IP-Layer Fingerprinting — Initial Window / TTL / MTU

Even before reaching the application layer, fingerprints already exist at the network layer. Every operating system's TCP/IP stack implementation differs slightly:

• Initial TTL: Windows defaults to 128, Linux 64, macOS 64, iOS 64
• TCP Initial Window Size: Windows 64KB, Linux 14600, macOS 65535
• TCP options order: different OSes send MSS / SACK / Timestamp options in a different order
• MTU: regular home broadband is 1500, PPPoE 1492, VPN tunnels typically 1380-1450

The p0f tool (passive OS fingerprinting) exploits exactly these fields, determining the peer's operating system without sending any probe packets. Sites can collect this information and compare it against your claimed UA — if your UA says Mac Safari, but the TTL is 128 and the Initial Window matches Windows values, you're actually running Windows with a spoofed Mac UA.

MTU can also leak "you're using a VPN" — since VPN tunnels typically have an MTU under 1500, the traffic is noticeably different from native broadband.

Defense:

• Use a TUN-mode VPN: the VPN server's own stack takes over, so the TCP/IP fingerprint sites see belongs to the VPN server, not your client
• OpenVPN / WireGuard default to TUN mode; HTTP/SOCKS proxies do not — this is the key difference
• Don't force the tunnel MTU up to 1500 just to "look less like a VPN" — tunnel encapsulation itself consumes tens of bytes, and overshooting causes fragmentation or a PMTUD black hole (large packets stall, pages half-load). Keep your client's default (WireGuard 1420, OpenVPN auto)

⑥ Behavioral Analysis — Traffic Timing + Input Habits

This is the hardest dimension to defend against, because it doesn't rely on any technical fingerprint at all, relying entirely on machine learning:

• Access time distribution: if your daily online hours are consistent across multiple accounts, that's the same person
• Mouse trajectory / scroll speed / keystroke rhythm: unique to every individual, and collected by banks / anti-fraud systems
• Session duration / navigation patterns: your browsing habits are unique
• Text input characteristics: your typing error rate, word choice preferences, and grammar

Defense:

• Strictly separate usage hours across accounts — don't log into "account A + account B" at the same time; stagger them by several hours
• When you genuinely need anonymity, switch devices (from laptop to phone / tablet)
• It's impossible to fully defend against this, but you can make correlation significantly harder

⑦ VPN Provider Logs + Legal Jurisdiction

This is the VPN's original sin. You trust that the VPN provider doesn't keep logs, but in reality:

• Commercial VPN providers can be acquired (Avast was acquired by NortonLifeLock → its privacy policy changed)
• A provider may secretly collect logs (in 2017, PureVPN handed user logs to the FBI, despite previously claiming to be "no-log")
• Legal subpoenas can force compliance — the US / UK / Canada / Australia / New Zealand (Five Eyes) all accept cross-border investigations
• Nine Eyes = Five Eyes + Denmark / France / Netherlands / Norway
• Fourteen Eyes = Nine Eyes + Germany / Belgium / Italy / Spain / Sweden

Selection criteria:

A self-hosted VPN gives you more control — but VPS providers (Vultr / Hetzner / DigitalOcean) keep their own logs and may also cooperate with investigations. True anonymity requires purchasing a VPS with cash / cryptocurrency plus registering under a fake identity, which is a substantial amount of engineering effort.

⑧ Cross-Account Correlation — Multiple Accounts Sharing Cookies / Fingerprints

After logging into account A, the browser stores cookies / localStorage / cache. If you switch to account B in the same browser, the site can immediately tell you're the same person.

• Same fingerprint + logging into multiple accounts within a short time window = cross-account correlation
• Cross-site cookie tracking (though modern browsers are starting to restrict this)
• Third-party tracking scripts (Google Analytics / Facebook Pixel) linking activity across sites

Defense:

• Firefox's Multi-Account Containers extension: each account gets isolated cookies / storage
• Chrome multi-profile setup (top-right avatar → add a user)
• Extreme measure: run different accounts in separatevirtual machines, each VM using a different VPN exit

Defense Strategy Summary Table

Practical Advice: How Anonymous Do You Actually Need to Be?

Before deciding how deep your defenses need to go, first figure out who's actually tracking you:

• Advertisers + data brokers (low intensity): uBlock Origin + rejecting third-party cookies + a regular VPN handles the vast majority of everyday scenarios
• Anti-fraud risk control (medium intensity): the above + consistent VPN DNS + matching timezone/language + isolated browser profiles
• Business competitors / web scrapers (medium-high intensity): the above + TUN mode + a genuine browser (no Selenium traces) + clearing residual cookies
• Government / cross-border investigations (extreme intensity): everything above is just the baseline. You need Tor / Whonix / Tails / a cash-purchased VPS + XMR + fully isolated devices

Most people only needlevels 1-2; level 3 and above is specialist territory.Don't burden your everyday use with anonymity you don't actually need.