I've been testing what a website can still tell about a visitor who's on a VPN, and the IP turns out to be the least interesting part. The things that kept giving people away in my tests:

• Time zone and language that don't match the exit IP. A Frankfurt exit with an Asia/Shanghai clock and zh-CN as the first language stands out.
• WebRTC handing out a local or real address, depending on the browser and the VPN client.
• Exits that differ per destination. With split tunneling or a proxy app, some sites see your home ISP and others see the VPN.
• The connection itself. The TCP and TLS fingerprint can say "this is a proxy" or name a different OS than your User-Agent claims.
• Canvas, fonts and GPU, which add up to a fingerprint that stays the same whichever server you pick.

I put these checks on one page: https://who.1ms.dog/. It's free, no account. Disclosure: I'm the author (香蕉痞 Yang), it's part of my 1ms.dog network-tools site, and the page itself isn't open source yet. The checks run in your browser. The servers don't keep a log or your IP, only anonymous per-value counters (used to show how rare your values are), and a "Don't count me" switch or Global Privacy Control turns those off. AI helped me write the code and this English text.

I'm curious what people here run. Does your setup pass the time zone and WebRTC checks, or do you just accept that and use a hardened browser? If a check looks wrong or misleading, tell me and I'll fix it.

I'm the author of this page, so take this as a "here's what I built and what I learned" post rather than a neutral review.

Who Are You shows what any website can read about a visitor without a single permission prompt, then writes it back as a plain-language portrait ("you're on X, in time zone Y, your DNS resolver is in Z..."). It currently reads 118 signals, split into what the server sees from the request and what JavaScript sees in the page.

A few things from building it that might be useful to other web devs:

• The server half is bigger than people expect. Before any JS runs, the request already carries IP, ASN, approximate city and coordinates, the IP's time zone, TLS version and HTTP protocol. On Cloudflare a lot of that comes straight from request.cf. Comparing that with what the page reports (system time zone, navigator.languages) is where most "you're using a proxy" verdicts come from.
• Spoofing extensions only change what JS reads. An extension that overrides the user agent or time zone patches navigator in the page, but the request headers stay the same, and a Web Worker often still reads the original values. Comparing the window with a Worker catches a lot of tampering.
• Fingerprint bits aren't independent. A 4K screen and a high-end GPU tend to come together, so the page doesn't multiply per-signal rarity. It counts the whole fingerprint against anonymous aggregate counts (no IP, no full fingerprint, no per-visit record).
• Some leaks aren't in the browser at all. WebRTC and DNS leaks, a direct-vs-proxied split, the extra round trip a proxy adds, and the TCP/TLS fingerprint of whatever actually wrote the packets. Changing the user agent doesn't touch any of those.

Each finding comes with a short "how to fix", and there's a mode for people who only care about privacy rather than appearing to be somewhere else.

Link: https://who.1ms.dog/ (also in zh, ja, ko, es, fr, de, pt, ru). It's part of the 1ms.dog set of free network tools. The main repo is public (github.com/yt1988/1ms.dog), but the code for this page isn't published yet, so I'm not calling it open source.

Disclosure: I'm 香蕉痞 Yang, I made it, and I used an AI assistant to help with the English. If you find a signal it reads wrong, or a check I'm missing, I'd really like to hear it.

Disclosure first: I'm the author of this page (香蕉痞 Yang), and I used an AI assistant to help write this post. It's free, no account, no ads.

I kept getting asked "why does site X still recognise me when I'm on a VPN?", so I built a page that shows the answer from the website's side. It reads what a normal site can read from your browser without any permission prompt (118 signals: timezone vs. IP location, languages, fonts, GPU/canvas, screen, network, etc.), then writes it up as one plain paragraph, the kind of profile a tracker could build.

The part I find most useful is the contradiction checks: WebRTC leaks, DNS leaks, and mismatches such as a US exit IP with an Asia/Shanghai timezone and zh-CN fonts, which is usually what gives away a VPN, proxy or a spoofed user agent.

Privacy notes, since this is the right crowd to ask: no IP is stored, only anonymous counts of how common each value is (used for the "how unique are you" part). The page itself is not open source yet; the wider 1ms.dog network toolset it belongs to is MIT on GitHub (yt1988/1ms.dog).

Link: https://who.1ms.dog/

Genuinely curious what people here see. Do Tor Browser / Mullvad Browser / LibreWolf with resistFingerprinting come out looking "common", and are there signals you think I'm missing or over-weighting?