Hi all, first post here.
Disclosure up front: I made this. who.1ms.dog (“Who Are You”) is part of my small set of network tools at 1ms.dog. It’s free, no account, and the source is MIT: github.com/yt1988/who-are-you. I used AI help to tidy up this write-up; I’ll answer questions in the thread myself.
Why I built it: a recurring theme in threads like the one about VPN exit IPs getting flagged for abuse is that a VPN swaps your IP, but a site still gets a dozen other signals, and when those signals disagree you look more suspicious, not less. I wanted one page that lays out what a site can see before you log in, and where the pieces don’t line up.
What it shows:
- Exit IP (v4 or v6, whichever you connected with), ASN/provider, rough location
- Which DNS resolver actually answers your lookups, and whether it’s in the same country as the exit IP
- Whether system timezone and browser language match the IP (classic: Mullvad exit in Boston, clock on Europe/Berlin)
- Browser fingerprint: canvas, fonts, GPU, screen/refresh rate, user agent, plus some headless/automation hints
- How rare that combination is among visitors to the page so far
Things worth comparing:
- LibreWolf / Firefox with
privacy.resistFingerprintingvs. stock Chromium - Mullvad Browser or Tor Browser defaults
- Router-level WireGuard vs. a browser proxy extension (the extension case often leaks a different DNS/timezone story)
Known weak spots, so you don’t have to dig:
- Without JavaScript the page is empty, even though IP and DNS would still be visible server-side.
- It sits behind Cloudflare, so the server only sees headers as Cloudflare forwards them. (Also means it’s partly blocked in Russia.)
- On an IPv6 connection it doesn’t separately evaluate your IPv4 exit.
- The A/B/C grade measures “how consistent do you look to a website”, not “how safe are you”. Tor + VPN gets a worse grade even though nothing real is leaking. I probably need to word that better.
- “Unique” means unique among visitors of this page, not the whole internet.
- Mobile Chrome can trip the automation heuristic in some cases; that’s a known false positive I’m looking at.
- Anonymous counting can be turned off on the page, and with GPC (Global Privacy Control) enabled nothing is counted.
What I’d most like from this crowd: cases where it gets your setup wrong (OPNsense/pfSense + WireGuard, Pi-hole/unbound, split tunnels, IPv6-only), and signals you’d expect a site to check that it doesn’t.
Yang