How each GlobeProxy tool works, and where its answers can be wrong

The principles

• Results come from real measurements of your connection, or from named public data sources. Nothing is invented or estimated without saying so.
• Where a result is only a likelihood, such as whether an address looks like a VPN, the tool says so and shows the reasons.
• We do not use analytics, advertising scripts or cookies, and tool results are not saved to a database. The privacy page lists the few things that are kept briefly.
• Free data is imperfect. A clean result is a statement about one moment and one method, not a guarantee that your connection is private or safe.

Our data sources

IP geolocation by DB-IP. Location data is approximate and is often wrong at city level, particularly for mobile networks, VPNs and addresses recently moved between companies.

What's my IP and IP lookup

What's my IP reads the address of the connection that reached our server. Our web server overwrites any client-supplied forwarding headers with the address it actually saw, so you cannot be shown a forged address. The location, network owner and time zone estimate come from the local DB-IP databases, so your address is not sent to another company to be looked up.

IP lookup does the same for an address you type. Limits: the location is where a database thinks the address is registered or used, not where a person is. The time zone is estimated from the country and coordinates. Private and reserved addresses are recognised and labelled instead of looked up. See IP address and ASN for the terms.

WebRTC leak test

When you press the button, your browser creates a WebRTC connection and asks the Google and Cloudflare STUN servers which addresses it can be reached at. The page collects the addresses that come back and compares them with the address our server sees. If a public address differs from the one you connect with, it flags a possible leak. Addresses that browsers hide behind random .local names are recognised and not counted as leaks.

Limits: the result depends on your browser and its settings, and a browser can behave differently in a private window or after an update. The test only checks what WebRTC reveals. It runs in your browser, so a blocked STUN request or a strict network can produce "nothing found" even when another network path leaks. Read about WebRTC and STUN.

DNS leak test

Your browser requests six images from random, never-used names under dnstest.globeproxy.com. Those names can only be resolved by asking our own DNS server, so the resolver that asks it is the one your device is using. Our server records the address of each resolver that asks, against the random test code, in memory only, for ten minutes. The page then looks up each resolver address in the local database to show its country and owner.

Limits: a resolver can sit behind a larger provider, so the owner shown is the network that contacted us, which may not be the company you configured. Large public DNS services show several addresses. The images are requests only meant to trigger the lookup, so your browser may log a certificate error for them. That does not affect the result. The test cannot see a leak that happens before or after the test itself. See DNS leak and our fix guide.

HTTP headers

The page makes a background request and our server echoes back the headers your browser sent, after removing internal ones added by our own web server. Cookie values are never returned, only the fact that a cookie was sent. The page adds notes explaining what common headers reveal.

Limits: you see what reaches our server, after any proxy or VPN in the path has added or removed headers. Browsers send different headers for page loads, scripts and images, so this view is one typical request, not every request.

VPN detector

The detector combines three signals for an address: whether the network number or name matches our list of cloud, hosting and VPN networks, whether the address is on the Tor exit list, and what the reverse DNS name suggests (words such as vpn or cloud point to hosting, words such as dsl or cable point to homes). It then returns one of four verdicts: likely VPN or hosting, Tor exit node, looks like a home or mobile connection, or unclear, with the reasons listed.

Limits: this is not full VPN or proxy detection. Many VPNs run on networks that are not on our list, and many companies run ordinary networks that are. Residential proxies look like home connections by design. Treat a flag as a clue and an unclear result as no information.

IP blacklist check

Our server asks seven public blocklists whether they list an IPv4 address, by reversing the address and querying each list's DNS name through the server's own resolver, as those lists require. An answer in the 127.x range means listed. No record means clean. Error codes, such as a refusal of queries from a public resolver, and timeouts after three seconds, are shown as unchecked and not as clean.

Limits: only IPv4 and only these seven lists, which is a small part of all reputation systems. Some email providers keep private lists we cannot see. Answers are cached in memory for an hour. The check is rate limited per visitor. Read about DNSBLs.

DNS lookup and reverse DNS

The tool sends your question to the public resolvers 1.1.1.1 and 8.8.8.8 and shows what they return for record types such as A, AAAA, MX, TXT and NS, or does a reverse lookup of an IP address. The answers are what those two resolvers believe at that moment, including anything they cached.

Limits: a recent change may not have reached those resolvers yet, and a different resolver may answer differently. The tool does not follow a full resolution from the root. See DNS and reverse DNS.

Proxy checker

You give a host, a port and a type (HTTP or SOCKS5), and optionally a login. Before connecting, our server resolves the host and requires every address to be an ordinary public address, so the tool cannot be used to reach private networks or this server. Some ports are refused. The server makes one request through your proxy to a page on this site, which reports the address and the headers it received. From that we measure speed, the exit address, its country and owner, and an anonymity level: transparent if your real address was passed on, anonymous if proxy headers appeared, elite if neither did.

Limits: one test is one sample, and speed varies from minute to minute. Credentials are used for the single test and not stored or logged. A proxy that treats our server differently from other sites can pass here and fail elsewhere. Our server is in a data centre, so the test shows how a proxy treats that kind of visitor. See proxy and SOCKS5.

Port checker

Our server makes a TCP connection back to your own IP address, the one it sees when you connect to us, on up to ten ports you choose, with a three-second timeout. It reports each port as open, closed or filtered. The tool never accepts any other address, and checks are limited per visitor.

Limits: it tests the path from our server to you, which can differ from the path from elsewhere. If you use a VPN or proxy, the address tested is the VPN's or proxy's. A filtered result can mean a firewall or simply no reply, so it is less certain than open or closed. See port and NAT.

IPv6 test

Your browser asks three names on this site, one reachable only over IPv4, one only over IPv6 and one over both, to return the address the request came from. The score out of 10 is worked out in your browser: 2 points when the IPv4 name answers, 4 when the IPv6 name answers, 1 when the dual-stack name answers, and 3 when the browser prefers IPv6 where both work. The three names only echo your address, with cross-origin access limited to this site.

Limits: it tests reaching our server over each protocol, not your whole network. A network can pass here and still have problems reaching other places, and a VPN can change the answer. See IPv6.

Browser fingerprint

The page reads details your browser exposes, such as screen size, language, time zone, graphics and audio behaviour, a drawing test and a probe of about 30 common fonts. It hashes some of them and adds rough entropy estimates, in bits, in the spirit of the EFF's Cover Your Tracks research, to show how identifying each one is. Everything is computed on your device and nothing is sent to our server or stored.

Limits: the bit values are rounded estimates, not measurements of how many people share your setup, because we have no population data. Real trackers use more signals and a database of visitors. A better test of uniqueness needs data we do not collect. See browser fingerprint.

User agent parser

The parser uses the open source ua-parser-js library (version 1.0.41, MIT licence) to split a user agent string into browser, engine, operating system and device, and adds our own bot detection and a view of browser client hints. It runs in your browser, so the string you paste is not sent anywhere.

Limits: a user agent is text that anyone can set. Browsers now shorten it, and new devices and bots appear faster than any library updates. Treat a parsed result as the string's claim, not proof of what sent it. See user agent.

Subnet calculator

Our own code calculates the network address, mask, broadcast address, first and last usable host and number of hosts from an IPv4 CIDR block, and the prefix range for IPv6, with a binary view. It runs in your browser and was checked against a set of unit tests, including edge cases such as /31 and /32 blocks.

Limits: it does the arithmetic only. It does not know how your network is configured or which addresses are in use. See subnet and CIDR.

Full border check

The border check runs the address, WebRTC, DNS and headers tests together and compares them: for example, whether the time zone matches the country of your address, and whether the network looks like hosting. The result card and the passport image are made in your browser and are not uploaded. By default the image hides most of your IP address and your city.

Limits: it inherits the limits of each test it uses. A pass means nothing it checked looked wrong at that moment.

Where we can be wrong, and how to tell us

The honest summary: our databases are free ones, our lists are short, and every result is a snapshot. When tools disagree with a provider's own claims, test again at a different time and from another network before deciding who is right. There is no public contact address on the site yet, and the privacy page will list one when there is. We update the date on a page only when its content changes.