I’ve been testing what a website can still tell about a visitor who’s on a VPN, and the IP turns out to be the least interesting part. The things that kept giving people away in my tests:

• Time zone and language that don’t match the exit IP. A Frankfurt exit with an Asia/Shanghai clock and zh-CN as the first language stands out.
• WebRTC handing out a local or real address, depending on the browser and the VPN client.
• Exits that differ per destination. With split tunneling or a proxy app, some sites see your home ISP and others see the VPN.
• The connection itself. The TCP and TLS fingerprint can say “this is a proxy” or name a different OS than your User-Agent claims.
• Canvas, fonts and GPU, which add up to a fingerprint that stays the same whichever server you pick.

I put these checks on one page: https://who.1ms.dog/. It’s free, no account. Disclosure: I’m the author (香蕉痞 Yang), it’s part of my 1ms.dog network-tools site, and the page itself isn’t open source yet. The checks run in your browser. The servers don’t keep a log or your IP, only anonymous per-value counters (used to show how rare your values are), and a “Don’t count me” switch or Global Privacy Control turns those off. AI helped me write the code and this English text.

I’m curious what people here run. Does your setup pass the time zone and WebRTC checks, or do you just accept that and use a hardened browser? If a check looks wrong or misleading, tell me and I’ll fix it.