What the test pages do with your connection details

The test pages show you your IP address, the HTTP headers your browser sent, the hostname of your address, an approximate location, and the proxy indicators found in them. These are worked out while the page is built and sent back to you. The pages themselves do not write them to a file or a database. What is kept is described below: the web server log and the DNS test on the Advanced Check page.

The site sets no cookies of its own.

Server logs

The web server keeps an access log for this site. Each line holds the client IP address, the date and time, the requested address including any query string, the HTTP status, the response size, the referring page, and the browser's User-Agent string. There is also an error log, which can contain the client IP address and the requested address.

Logs are rotated daily and seven are kept, so entries are deleted within seven days. A copy also goes to the server's container log, which is capped at a few tens of megabytes and holds well under a day.

The logs are used to run and protect the site. fail2ban reads them and blocks an address for 24 hours when it makes requests no ordinary visitor makes, such as asking for .asp pages.

Logs are not shared and not combined with other data.

ipv6.whatismyproxy.com, and the Advanced Check addresses under x.whatismyproxy.com when reached over IPv6, write a separate log (ipv6.whatismyproxy.com) with the same contents and the same seven-day rotation. tor.whatismyproxy.com only redirects to the onion address and logs those requests the same way.

Lookups made while building the results

Reverse DNS. The server looks up the hostname of your IP address. That query goes to the DNS servers responsible for your address range, which are usually run by your ISP or hosting provider.

Tor exit list. The server makes a DNS query to exitlist.torproject.org to check whether your address is a Tor exit node. The name it asks for contains your IP address and this server's address and port. That service is run by the Tor Project.

Location. The approximate location is taken from a copy of DB-IP's IP to City Lite database stored on this server. No request is sent to DB-IP.

Advanced Check: the DNS server test

The Advanced Check page is loaded from a random address such as xxxxxxxx.x.whatismyproxy.com. The random part is made up each time the page links to it. When a DNS resolver looks that name up, this site's DNS server records the random name, the IP address of the resolver that asked, the exact bytes of its query, and the time. The page then reads these rows back and shows them in the "DNS Server Check" table.

The resolver is usually your ISP's or a public DNS service, so this is normally the resolver's address and not yours.

These rows are deleted 60 minutes after they are written. The deletion runs every 5 minutes, so a row is gone within about 65 minutes. Until then, anyone who opens the same random address sees the same table.

The DNS server also keeps a small table of resolver addresses with a query count and a time, used to drop floods of queries. It is shared with dnsparanoia.com's DNS server. There is no scheduled deletion for this table.

If one address asks for more than 60 different names under x.whatismyproxy.com within 60 seconds, the DNS server writes a line with that address and the time to a log, and fail2ban blocks that address for 24 hours. This log is rotated weekly and four are kept, so lines are deleted within about five weeks.

Advanced Check: the other tests

Reverse traceroute. The server runs a traceroute to your IP address and shows you the output. It is not stored.

Reverse TTL. Your browser loads small images from this server on ports 9001 to 9032. The program that serves them does not record who asked.

Form data check. Your IP address and your Via and X-Forwarded-For headers are sent back to the server in a GET and a POST request and compared with what arrives. Nothing is stored; the GET request's address appears in the access log like any other request.

File extension check. Your browser requests files under /extcheck/ whose names contain your IP address. These requests appear in the access log like any other request.

Local addresses. The pages ask your browser for its local network addresses (WebRTC) and show them on the page. This happens inside your browser; the addresses are not sent to the server.

Other services on this server

The raw header page on port 8080 sends your request back to you as it arrived. The FTP service on port 21 tells you your IP address and source port. Neither program writes visitor addresses to a file or database.

Advertising

The home page shows Google AdSense ads. Google, and other advertising companies that Google works with, use cookies to choose ads based on your earlier visits to this site and to other sites. You can turn off ads personalised in this way: for Google, in Google's My Ad Center; for other participating companies, at aboutads.info or, in Europe, youronlinechoices.eu.

Content loaded from other sites

Some pages make your browser load files from other companies' servers. When that happens, those servers receive your IP address, your User-Agent, and usually the address of the page you are on, and their own privacy policies apply.

• The home page loads jQuery from code.jquery.com.
• The home page loads Google's AdSense script from pagead2.googlesyndication.com. Google can set and read its own cookies through it. See Google's description of how it uses advertising data.
• On IPv4, the home page shows a map centred on your approximate location. Your browser loads the map images from tile.openstreetmap.org, run by the OpenStreetMap Foundation, which can see which area was requested.
• The "page not found" page loads the Google Maps script from maps.google.com, a Facebook "Like" frame from facebook.com, Google's +1 script from apis.google.com, and Twitter's widget script from platform.twitter.com.

The FAQ, list of tests, SSL check, contact, embed and privacy pages load files only from this site.

The embeddable widget

A site that embeds the widget makes its visitors' browsers request js.php from this server. Those requests are logged like any other, and the referring page is the page the widget is on.

The Tor onion version

The onion version is a single page. It shows your request headers and the Tor relays this server is connected to. It does not load any file from another site, and it has no DNS test.

Connections to it arrive through the Tor program on the same machine, so the address the server sees and logs is its own (127.0.0.1), not yours. Its web server log goes only to the container log, not to a log file.

Sharing

The records described here are not sold or shared. The site's operator has access to them.

Contact

Questions about this page can be sent using the details on the contact page.