What does this check look at?

Whether properties sites read (user agent, platform, languages, screen) were redefined instead of coming from the browser, whether the drawing and audio functions fingerprints use were replaced, whether the JavaScript engine matches the user agent, whether the request header's language matches the one in JavaScript, and whether Date and Intl agree on the time zone. Every other check on the page counts toward the grade too.

Why do extensions that change the user agent get caught?

They change what JavaScript reads, but not the request headers the browser sends, the engine underneath, or the functions they wrap. Each mismatch is something a site can compare. To seem to be elsewhere, change the system itself: its language and time zone.

No. The checks run in your browser; the server only answers with what it sees of this request, and keeps nothing.

Browser environment check

Sites that fight fraud don't just read your IP: they check that everything your browser says fits together. A user agent that says Safari on a Chromium engine, a language set only in JavaScript, a time zone that two APIs disagree on: each is a giveaway. Here is what this browser says, and where it contradicts itself.

Tampering check

JS engine…
Browser…
User agent…
Languages…
Browser languages…
System time zone…
Installed fonts…

79 sniffers · no permission asked

Who sites think you are

You're probably from , and right now you're in . You speak , and your computer runs on with a clock.

You're on , using , with a screen and graphics: .

You get online through , ; the DNS server that looks up sites for you is in . .

You like , and . . Your fonts drop a hint: . As for your age, .

Browser fingerprint IDThe same on every site, in private windows and behind a VPN

Disguise check

–

Sniffing…

Time zone vs IP
- Set the system time zone to the IP's
- Windows: Settings → Time & language
- macOS: System Settings → General → Date & Time
Language vs IP
- Put the IP country's language first in the browser
- Not passing as a local? Leave it
System language vs IP
- The system has another language pack installed, and its fonts and voices show it
- Use a system or virtual machine without those languages
- Or pick a region that matches the system's language
DNS leak
- Clash / Mihomo: DNS with fake-ip, or TUN mode
- V2Ray / Xray: send DNS through the proxy too
- Browser: turn on Secure DNS
Split routing
- To hide it: switch to global mode
- Local sites going direct on purpose? Leave it
WebRTC leak
- Proxy client: turn on TUN mode
- Or limit WebRTC in the browser (Chrome: WebRTC Network Limiter)
Round trip
- A proxy always adds this leg, and sites can measure it
- A server closer to you, with less latency, narrows the gap
- Residential or mobile exits raise fewer eyebrows than data center IPs
Data center IP
- Use a home or mobile exit instead
- Streaming, AI and payment sites often block data centers
User agent vs system
- Don't change the user agent alone: the graphics card gives it away
- Need several identities? Use an anti-detect browser
Tampered environment
- Extensions that change the user agent, language or time zone only change what JavaScript reads; the request headers and the functions underneath stay as they were
- To pass for elsewhere, change the system itself: its language and time zone
- With an anti-detect browser, make sure its settings agree with each other
Trackable fingerprint
- Use Brave (scrambles the fingerprint)
- Or Firefox with resistFingerprinting
- Or Tor Browser
Automation
- Close Selenium, Puppeteer or other automation, then reload

Connection

HTTP/3
- Let the proxy carry UDP (Clash / Mihomo: TUN mode, udp: true)
- Allow UDP 443 on the firewall
- Check QUIC isn't turned off in the browser
ECH
- Turn on secure DNS (DNS over HTTPS) in the browser
- Proxy: turn off fake-ip, or have its DNS return HTTPS records
- Use a browser that supports ECH: Chrome, Edge, Firefox
Post-quantum
- Update the browser
- Turn off HTTPS scanning in your antivirus, or ask whether the company proxy decrypts traffic
WARP
- Cloudflare WARP: switch it in the 1.1.1.1 app

Where do you want to seem to be?

Target region

Every sniffer and what it read

Any site can read all of this, without a permission prompt.

What the server sees15

IP address…CF-Connecting-IP

Location…request.cf.city

Coordinates…request.cf.latitude

Network (ASN)…request.cf.asOrganization

DNS resolver…edns.ip-api.com

Time zone of the IP…request.cf.timezone

Reverse DNS…DNS PTR

Nearest data center…request.cf.colo

HTTP and TLS…request.cf.tlsVersion

Key exchange…/cdn-cgi/trace · kex, sni

Cloudflare WARP…/cdn-cgi/trace · warp

TLS fingerprint…TLS ClientHello

Your clock…Date.now()

WebRTC addresses…RTCPeerConnection · STUN

Local address…WebRTC host candidate

Exits6

Site in mainland China…myip.ipip.net

IP service abroad…api.ip.sb

ChatGPT…chatgpt.com/cdn-cgi/trace

Claude…claude.ai/cdn-cgi/trace

Cloudflare…www.cloudflare.com/cdn-cgi/trace

IPv4 and IPv6…Cloudflare Radar · IPv4 / IPv6

Request headers7

User agent…User-Agent

Languages…Accept-Language

Browser brands…Sec-CH-UA

Platform…Sec-CH-UA-Platform

Compression…Accept-Encoding

Do Not Track…DNT · Sec-GPC

Came from…Referer · document.referrer

Language and region8

Browser languages…navigator.languages

Locale…Intl.DateTimeFormat

System time zone…Intl …timeZone

Clock format…Intl …hourCycle

Week starts…Intl.Locale weekInfo

Number and date format…Intl.NumberFormat

Keyboard layout…navigator.keyboard

Speech voices…speechSynthesis

Fingerprints7

JS engine…Error.message

Canvas…canvas.toDataURL

WebGL…WebGL getParameter

Audio…OfflineAudioContext

Font list…fonts → SHA-256

Combined fingerprint…SHA-256

Fingerprint protection…canvas × 2

Device22

Operating system…userAgentData

Browser…userAgentData.brands

CPU architecture……architecture · bitness

Screen…screen · devicePixelRatio

Refresh rate…requestAnimationFrame

Screens…screen.isExtended · screenX

Window…innerWidth · availHeight

Graphics card…WebGL RENDERER

WebGPU…navigator.gpu adapter.info

WebGL capabilities…WebGL2 · MAX_TEXTURE_SIZE

CPU cores…hardwareConcurrency

Memory…navigator.deviceMemory

Touch and pointer…maxTouchPoints · pointer

Battery…navigator.getBattery

Connection…navigator.connection

Cameras and mics…enumerateDevices

Audio hardware…AudioContext.sampleRate

Biometrics…PublicKeyCredential

Bluetooth…bluetooth.getAvailability

Video codecs…MediaSource.isTypeSupported

DRM…requestMediaKeySystemAccess

Storage quota…storage.estimate

Browser settings14

Color scheme…prefers-color-scheme

Animations…prefers-reduced-motion

Display colors…color-gamut · dynamic-range

Accessibility…prefers-contrast · forced-colors

Opened as…display-mode

Privacy signals…doNotTrack · GPC

Cookies…navigator.cookieEnabled

Permissions…permissions.query

PDF viewer…pdfViewerEnabled

Automation…navigator.webdriver

Ad blocker…bait element

Extensions…window.ethereum · DOM marks

Tab history…history.length

Installed fonts…canvas measureText

Browser environment check

Tampering check

Who sites think you are

Where do you want to seem to be?

Every sniffer and what it read

What the server sees15

Exits6

Request headers7

Language and region8

Fingerprints7

Device22

Browser settings14

More 1ms.dog tools

Speed & connectivity

IP & privacy

Cloud picks & costs

Help

What does this check look at?

Why do extensions that change the user agent get caught?

Is anything stored?

Browser environment check

Tampering check

Who sites think you are

Where do you want to seem to be?

Every sniffer and what it read

What the server sees15

Exits6Full check

Request headers7

Language and region8

Fingerprints7

Device22

Browser settings14

More 1ms.dog tools

Speed & connectivity

IP & privacy

Cloud picks & costs

Exits6