Anonymity Check

HTTP proxy headers

Some proxies and CDNs add headers such as Via, Forwarded, Proxy-Connection or X-Proxy-*. OrbitNet ignores its own infrastructure headers (Cloudflare/Caddy/nginx) so they are not counted as your proxy. A CDN can also add similar headers, so this is a hint rather than proof.

Open proxy and VPN ports

The active check connects to a short list of TCP ports commonly used by HTTP proxies (3128, 8080, 8000, 8118, 8888, 8889, 8123), web proxies (80, 443, 8080, 8443, 3128) and VPN services (1194, 1723, 443, 4443, 51820). A closed port proves nothing: the service may be bound to UDP, firewalled, or simply not running. An open port is also not proof of a proxy — for example, port 443 may belong to a normal web server or router. UDP-only services such as WireGuard and most IPsec VPNs cannot be detected with a TCP connect. If you are behind carrier-grade NAT or a corporate gateway, the checked address is the shared public gateway, not your device.

Suspicious hostname (PTR)

Home ISPs often give addresses names like ppp-203-0-113-7.dial.example.net. Hosting and privacy providers frequently use words such as vps, server, cloud, vpn, proxy or a provider name. A missing PTR is neutral and is not treated as a warning.

Timezone difference

The page compares your browser's IANA timezone with the timezone MaxMind associates with your public IP. A VPN endpoint in another country often creates a mismatch. Travel, a wrong device timezone, or an inaccurate geolocation database can create the same result.

Tor network membership

Your public IP is compared with the Tor Project's public bulk exit-node list. The list is cached on the server for one hour. Only exit nodes are listed: using Tor does not always mean that your traffic leaves through an exit node that is in this list at the moment of the check. If the list cannot be downloaded, the result is shown as unknown rather than “not Tor”.

Hosting provider / ASN

MaxMind's ASN organisation is matched against a list of cloud, VPS, datacenter and privacy providers. A hosting ASN means the address belongs to a server network, not necessarily that the visitor is hiding. Many people use a VPS or corporate cloud egress normally.

WebRTC IP leak

By default the browser gathers ICE candidates without a STUN server. Modern browsers usually hide local addresses behind mDNS, and without STUN they generally cannot discover the public address that a proxy or VPN would expose. Enable the STUN option above to contact a public STUN server and obtain the public IP the browser would use; if that public IP differs from the IP observed by the server, it is a strong proxy, VPN or split-tunnel signal. Local/private candidates still reveal information about your local network, but they are the only result in the default mode.

Web proxy (browser-side heuristic)

JavaScript cannot reliably detect an HTTP proxy by itself. This row combines the browser-side inconsistencies available to the page: a public WebRTC address that differs from the HTTP address (only when the STUN option is enabled) and a browser/IP timezone mismatch. It is deliberately labelled as a heuristic.

Tunnel detection (two-way ping)

The page sends three small request/response probes to the OrbitNet API and measures median round-trip time and jitter. High or unstable latency can accompany a tunnel, but it is a very weak signal: Wi-Fi, mobile networks and distance produce the same effect. The WebRTC comparison is a stronger indicator.

VPN fingerprint

This row combines hosting ASN, PTR keywords, timezone mismatch, WebRTC results and open VPN ports into one summary. It is a heuristic fingerprint, not a device fingerprint and not proof of VPN use.

Score and evidence

The score is a weighted sum of the signals above, capped at 100. A higher score means more evidence of proxy, VPN, Tor or hosting use — not better anonymity. It is best read as “how many independent anonymising signals were visible”, not as a calibrated probability. A Tor exit listing alone produces a very high score because it is a direct membership check. Conversely, a low score does not prove that no proxy is in use.

Privacy and safety

Passive checks are resolved by the OrbitNet backend. The Tor exit list is downloaded from check.torproject.org and cached for one hour. The optional WebRTC STUN test contacts a public STUN server (Google) only if you enable it. Active port checks are limited to the IP that makes the request and cannot be pointed at another host. Like any web service, the server and reverse proxy may keep standard technical access logs. No third-party analytics or advertising scripts are used.