What the edge sees
This site runs as a single Cloudflare Worker. When your browser connects, Cloudflare's edge exposes properties of the connection itself to the Worker: the connecting address, the autonomous system number announcing it, a geolocation estimate, the negotiated TLS version and cipher, the HTTP protocol, and the measured TCP handshake round-trip time. These are read from the live connection, not looked up afterwards.
ASN resolution and classification
Arbitrary address and ASN lookups resolve through the Team Cymru IP-to-ASN mapping service, queried over DNS-over-HTTPS from the edge. That service is fed by the global BGP routing table, so the announced prefix shown is a real current route.
Classification into residential, mobile, datacenter, VPN or Tor uses a curated table of 243 hosting networks, 54 VPN-associated networks, 64 mobile carriers and 86 US residential ISPs, every entry checked against the RIPE NCC asnames registry. Where an ASN is not in the table, a conservative keyword heuristic runs against the operator name, and anything still ambiguous is reported as unclassified rather than guessed.
What runs in your browser
The WebRTC, DNS integrity, IPv6, locale and latency tests all execute client-side. The WebRTC test opens a real RTCPeerConnection against public STUN servers and enumerates ICE candidates for 2.6 seconds. The DNS test queries four independent DNS-over-HTTPS providers in parallel and compares their answers. The IPv6 test performs TLS handshakes to 1.1.1.1 and [2606:4700:4700::1111] by IP literal, both of which are valid names on Cloudflare's resolver certificate.
None of those results are transmitted to us. They are computed and displayed locally.
What we deliberately do not do
- No city-level geolocation for arbitrary addresses. Registry data gives a country; anything finer is a commercial inference, and it is wrong often enough that presenting it as fact would be dishonest.
- No invented risk scores. There is no proprietary "fraud score" here. Classification is explained, and the inputs are listed.
- No DNS leak test that is not one. A true leak test requires a wildcard DNS zone under a domain we control. Until a custom domain is attached, we run a resolver integrity test and say so plainly.
- No blacklist checks. The major DNS blocklists reject queries arriving via public resolvers, so any result we could produce from the edge would be unreliable.
Data currency
ASN registry data is resolved live per request. VPN provider data was verified from primary sources in August 2026 and is dated on each page; fields that could not be confirmed are left blank rather than estimated. Guides carry their own last-updated date.