How your IP is detected and leaked: user agents, fingerprints & WebRTC

Every site you visit collects more than you think. This guide walks through exactly how a server identifies your IP and device, where the most common leaks come from, what your User-Agent gives away, and what the real consequences look like.

How a website actually sees your IP

When your browser opens a TCP connection to a server, the server's operating system already knows the source IP — it's needed to send the response back. There is no way to "browse without an IP". The interesting question is which IP the server sees:

On a direct connection — your home router's public IP (or your mobile carrier's NAT IP).
Behind a VPN — the VPN exit server's IP.
Behind a proxy — the proxy's IP.
Behind a CDN like Cloudflare — the CDN sees your real IP and forwards it to the origin via X-Forwarded-For / CF-Connecting-IP.

That last point matters: modern apps don't trust the raw TCP source on its own. They look at headers like X-Forwarded-For, X-Real-IP, True-Client-IP and CF-Connecting-IP to recover the real client behind any reverse proxy. Our checker does the same.

What the User-Agent header reveals

Every HTTP request carries a User-Agent string. It is your browser introducing itself. A typical one looks like:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

From that one line a server can extract:

browser family and version (Chrome 126);
rendering engine (Blink / WebKit);
operating system and version (macOS 10.15);
device type (desktop, mobile, tablet, bot);
CPU architecture in some cases.

Tools and bots usually identify themselves too: curl/8.6.0, python-requests/2.31, Googlebot/2.1. That's why ip.scanforsecurity.com returns plain JSON when called by curl, wget, Python or similar — it detects them via the User-Agent.

Macro photo of a circuit board — The User-Agent is one of dozens of signals a server can read from every request.

The other signals servers combine

Accept-Language — what languages your browser asks for, often revealing your country.
TLS fingerprint (JA3/JA4) — the exact set of ciphers and extensions your client offers during the TLS handshake. Different from what a User-Agent claims is a strong bot signal.
HTTP/2 fingerprint — the ordering of headers and settings frames differs between browsers and libraries.
Canvas, WebGL, fonts, audio context — small differences in how your GPU and OS render things produce a near-unique fingerprint.
Cookies, localStorage, IndexedDB — long-lived identifiers from previous visits.
Behavioural signals — mouse movement, timing, scroll patterns.

Any one of these is forgeable. The combination is what makes you re-identifiable across IP changes — and why simply switching IPs does not make you anonymous.

How your real IP leaks even behind a VPN

WebRTC

The browser API behind video calls can ask STUN servers for your local and public IPs. Many sites use this purely to deanonymise visitors. Our leak test triggers a controlled STUN exchange and compares the result with the IP the server saw.

DNS

If your operating system keeps using its old resolver after the VPN comes up, every hostname you visit still flows through your ISP. The ISP can build a complete map of your browsing even though the actual page contents are encrypted.

IPv6

Older VPN clients only tunnel IPv4. IPv6 traffic exits via your normal connection, with your real address.

Browser extensions and apps outside the tunnel

Split-tunnelling, misconfigured proxies and badly behaved apps (especially native mobile apps) often bypass the VPN entirely.

What can actually happen if your IP is exposed?

Location disclosure — city-level geolocation is generally accurate; ISP and ASN are essentially always correct.
Account correlation — sites that see the same IP and fingerprint across visits can link "anonymous" accounts to identified ones.
Targeted attacks — port scanning, DDoS, and exploitation of home-router vulnerabilities all start from a known IP.
Doxxing — combined with leaked data, even a residential IP can point to a building or household.
Reputation damage — datacenter and known-VPN IPs are increasingly blocked, captcha-walled or priced differently.

What you can do

Use a reputable VPN with a kill switch and DNS leak protection.
Disable WebRTC in your browser (most privacy-focused browsers expose a toggle).
Use a privacy-respecting DNS resolver (Cloudflare 1.1.1.1, Quad9).
Reduce fingerprint surface — Tor Browser, Mullvad Browser, or Firefox with resistFingerprinting.
Separate identities: don't log in to personal accounts from your "anonymous" browser.
Periodically run an IP and leak test — including ours.

Run the full check on yourself

Open the homepage of ip.scanforsecurity.com to see the exact IP, ASN, geolocation, device, browser and headers any server can read about you right now. Click Run leak test to check for WebRTC, DNS and timezone leaks. If you're scripting this from a server, the same data is available as JSON:

curl https://ip.scanforsecurity.com

How your IP is detected and leaked: user agents, fingerprints and WebRTC