How our tools work

We only use data whose publisher allows this use, and we show its attribution and update date wherever it appears. The /v1/sources endpoint behind the site lists every dataset with its live status; this table is the human version.

Deliberately not used: MaxMind GeoLite2 (license terms), IP2Location LITE (account required), ip-api.com (non-commercial only), Spamhaus and CBL (commercial use requires a paid subscription), SORBS (shut down 2024), PeeringDB (reproduction requires approval), AbuseIPDB (API key required). We would rather show fewer sources than sources we are not allowed to show.

No database knows where an address is; each one infers a place for a block from registry records, operator geofeeds, latency measurements and usage patterns, and rebuilds the guess periodically. We therefore query several and show them next to each other.

Cloudflare's live edge geolocation (where our edge saw the connection come from), DB-IP Lite (monthly), and IPinfo Lite (country-level, when configured) vote on country and city. The registry country from iptoasn.com is shown for comparison but never votes: it is where the block was allocated, which for a multinational can be a different continent. The consensus is the value the voting sources agree on, with a confidence that drops when they disagree or when only one source has data, and a spread (kilometers between the sources' coordinates) so you can see the disagreement in numbers. Prefixes that are announced from many locations at once (anycast) are flagged and their confidence is capped.

Blocks get reassigned faster than databases rebuild; large ISPs and mobile carriers route traffic through regional gateways; VPN, proxy and cloud addresses are located where the server is, by design; IPv6 coverage in free databases is thinner than IPv4; anycast addresses have no single location. The guide why your IP location is wrong covers each case. City-level is the best possible outcome; street-level claims from any provider are marketing.

The leak tests measure what actually leaves your device, not what your settings say. Everything they need runs on infrastructure we operate ourselves so that no third party sees your test.

We run the only authoritative nameserver for the zone dnstest.checkmyip.com. For each test your browser is given unique hostnames under that zone (six in the standard test, thirty-six extended) and loads a tiny resource from each. Every recursive resolver that handles your lookups has to ask our nameserver, and our server records the resolver's address for that session. Each resolver is classified: same address as you (you run your own resolver), same network as your HTTP address, a known public resolver, or other (an ISP's or VPN provider's resolver). Where a resolver forwards EDNS Client Subnet we compare the forwarded prefix with your visible address; a prefix that does not contain it proves the query entered the resolver from a different network. The verdict table (leak / possible leak / no leak / review, each with a confidence) is applied exactly as documented in our service interface, and the resolver list is always shown so you can check the reasoning. Sessions expire after ten minutes and are never written to disk.

Your browser gathers ICE candidates against our own STUN server (stun.checkmyip.com, UDP and TCP, IPv4 and IPv6). The server-reflexive candidate is the public address our STUN server saw your UDP packet arrive from; we compare it (and any public host candidate) with the address your browser uses over HTTP, including the IPv4-only and IPv6-only views. A public address that websites do not already see is reported as a leak; local and mDNS candidates are shown but only noted as LAN layout visible. The comparison runs in your browser; candidates are not sent to us.

Three hostnames resolve respectively to an IPv4-only address, an IPv6-only address and both. Your browser fetches a small JSON file from each; which fetches succeed and which family the dual-stack host sees tell us whether you have IPv4 only, dual-stack preferring IPv6, dual-stack preferring IPv4 (often a sign of a slow or broken IPv6 path) or IPv6 only. In the VPN test, an IPv6 address from a different network than your VPN's IPv4 address is reported as an IPv6 leak.

An address is reported as a Tor exit when it is on the Tor Project's exit list (refreshed hourly). It is reported as a VPN or data center address when it falls in the X4BNet VPN or data center ranges, in the official cloud providers' published ranges, or when its ASN is a hosting network; as an iCloud Private Relay egress when it is on Apple's list; and as a proxy when a DNS blocklist that tracks open proxies lists it. Residential, mobile and business classifications come from the network type of the ASN. Each verdict carries a confidence (high for list hits, medium or low for heuristics) and the list of reasons. On your own connection we add browser-side signals: a device time zone that differs from the address's time zone, and WebRTC or DNS results that point at a different network. The risk score (0–100, levels low / moderate / high / severe) adds fixed weights per signal — for example +20 for a hosting range, +50 for a known botnet command server — and the weights are published with a version number so a score can be reproduced.

The privacy score on the privacy score page starts at 100 and subtracts a fixed amount per finding, in two modes. VPN mode (you told us you are on a VPN): −40 if the visible address is your ISP's rather than a VPN's, −25 for a DNS leak, −20 for a WebRTC leak, −15 for an IPv6 leak, −10 for a time-zone mismatch, −10 if the address is on a blocklist. Normal mode (no VPN): −10 for a WebRTC-exposed local network, −10 for a time-zone mismatch, −20 for a blocklisted address. The browser-fingerprint check is shown as an estimate and is not deducted in this first version; the −10 for a highly unique fingerprint will be switched on once uniqueness is measured from real samples, and this page will say so. The score is never below 0; bands are 90–100 excellent, 70–89 good, 40–69 fair, below 40 poor. The formula is deliberately simple so that the fix list and the score always agree.

We query ten DNS blocklists in parallel through our own recursive resolver, as the list operators request, and cache the answers for ten minutes. We only use lists whose operators publish terms allowing free public queries and that answered the standard test entry on 2026-10-21. UCEPROTECT levels 2 and 3 list whole allocations and ASNs and are shown as informational, not counted against you. A query refused by a list is reported as an error, never as a listing. Each result shows the list, its category, the return code and its documented meaning, when it was checked and where to request removal.

We do not store visitor addresses. Lookup results are cached for ten minutes, in the lookup server's memory and at the edge (Cloudflare KV, keyed by address); leak-test sessions live in memory for ten minutes; nothing identifying is written to disk or to a database. Aggregated usage counts (page, day, country, language, device class) contain no addresses. Our servers' own health reports contain the servers' addresses and load, not yours. See the privacy policy.

2026-10-21 — Site launched after a complete rebuild. Geolocation: Cloudflare edge + DB-IP Lite (build 2026-10-01), IPinfo Lite prepared. Network: iptoasn.com, DB-IP ASN Lite, Team Cymru, RIPEstat, RDAP. Risk: Tor exits, X4BNet, cloud feeds, iCloud Private Relay, Feodo Tracker, ten DNSBLs; score version 2026-10-21.1. Leak tests on our own DNS zone and STUN server. Future changes to sources, weights or test design are recorded here with their date.