IPGuard Detection Principles & Technical Architecture

IPGuard is a 100% client-side IP purity, datacenter vs. residential ASN, and browser anti-association auditor that cross-verifies 8 threat-intelligence feeds and 5 DNSBL blacklists over HTTPS in under 5 seconds while keeping all state in localStorage with 0 bytes uploaded.

IPGuard simultaneously exposes 4 network exits (Global Proxy, Domestic Direct, Cloudflare Edge, and WebRTC STUN UDP) and audits 10 bypass leak channels including IPv6, WebSocket, WebTransport, HTTP/3 QUIC, DNS Prefetch, Preconnect, and Beacon across 4 languages with full JSON export.

100% Client-Side (0-Byte Upload) 8 Threat DBs + 5 DoH DNSBL Team Cymru RIR TXT Lookup P0 / P1 / P2 10-Channel Leak Matrix TLS JA3 & Post-Quantum X25519MLKEM768 Canvas · WebGL · Audio · Font SHA-256

⚙️ 6 Core Inspection Engines & Methodology

01 · 4-Channel Simultaneous Exit Exposure & Split-Tunnel Deduction

Multi-Exit Topology

IPGuard concurrently probes overseas HTTPS intelligence endpoints, domestic direct ISP endpoints, Cloudflare /cdn-cgi/trace edge nodes, and WebRTC STUN UDP sockets in under 5 seconds to expose all 4 network exits simultaneously, 100% automatically deducing Split-Tunnel, Global TUN, or Direct routing.

Exit 1 (Global HTTPS): api.ipapi.is · ipinfo.io · ipwho.is Exit 2 (Domestic Direct): myip.ipip.net · ip.useragentinfo.com Exit 3 (Cloudflare CDN): cloudflare.com/cdn-cgi/trace (Colo + WARP + HTTP/3) Exit 4 (WebRTC STUN UDP): stun.cloudflare.com:3478 · stun.l.google.com:19302

02 · 8-Source ASN Voting & Official RIR Native vs. Broadcast Audit

ASN & DoH RIR

IPGuard executes a weighted voting algorithm across 8 threat feeds, a built-in cloud/VPS ASN registry, and AliDNS DoH reverse PTR records to separate Datacenter Hosting from Residential ISPs, while querying Team Cymru asn.cymru.com TXT records over HTTPS to verify 100% Native vs. Broadcast IPs.

DoH RIR Origin Query : <reversed-ip>.origin.asn.cymru.com (TXT) DoH ASN Registry : AS<number>.asn.cymru.com → ARIN | RIPE | APNIC | LACNIC | AFRINIC Native IP Verdict : RIR Allocated Country === GeoIP Physical Country DoH DNSBL Lookups : zen.spamhaus.org · b.barracudacentral.org · bl.spamcop.net

03 · P0 / P1 / P2 Full-Stack 10-Channel Bypass Leak Matrix

10-Channel Leak Matrix

IPGuard tests 10 distinct networking pipelines across P0/P1/P2 priorities using dynamically generated 32-hex subdomains to bypass OS DNS caches, verifying whether IPv6 AAAA, WebSocket, WebRTC, WebTransport QUIC, HTTP/3, DNS Prefetch, Preconnect, or Beacon leak your real ISP IP.

P0 (Core) : IPv4 HTTPS · IPv6 AAAA (api6.ipify.org) · WebSocket (wss://) · WebRTC UDP P1 (UDP/DNS): WebTransport QUIC · HTTP/3 Alt-Svc · <link rel="dns-prefetch"> · <link rel="preconnect"> P2 (Bg/Port): navigator.sendBeacon() · <img> Subresource · 127.0.0.1 Proxy Ports · SDP MTU

04 · TLS Handshake (JA3 / Post-Quantum) & Outbound Header Audit

TLS JA3 & Split-TCP

IPGuard inspects live ClientHello cipher suites, JA3 hashes, and X25519MLKEM768 post-quantum groups over HTTPS to detect middlebox TLS termination, X-Forwarded-For dirty header injection, or local proxy Split-TCP interception where TCP Connect latency is far smaller than HTTP TTFB.

TLS ClientHello : JA3 MD5 Hash · TLS 1.3 Cipher Suites · X25519MLKEM768 PQ Group Header Integrity: Outbound Header Order Hash · Sec-CH-UA vs User-Agent · Via / XFF Check Split-TCP Ratio : ResourceTiming (connectEnd - connectStart) vs (responseStart - requestStart)

05 · Hardware Fingerprinting & CreepJS-Style Anti-Tamper Audit

SHA-256 Hardware Entropy

IPGuard computes deterministic SHA-256 hashes in browser memory across Canvas 2D pixel rendering, WebGL unmasked GPU renderers, WebAudio oscillator dynamics, and Canvas measureText system font widths with 0 bytes uploaded, while auditing Function.prototype.toString hooks and navigator.webdriver.

Hardware Hashes : SHA-256(Canvas 2D) + SHA-256(WebGL GPU) + SHA-256(OfflineAudioContext) OS Font Infer : Canvas 2D ctx.measureText() width delta across macOS / Windows / CJK fonts Anti-Tamper : Function.prototype.toString native code audit + navigator.webdriver check

06 · Deterministic IP Purity & Environment Consistency Scoring Model

Deterministic Scoring

IPGuard calculates reproducible 0–100 IP Purity and 0–100 Environment Consistency scores using transparent deduction weights for Datacenter Hosting, Broadcast IPs, VPN/Proxy flags, DNSBL hits, and mismatches across IP timezone, system language, WebRTC, and EDNS resolvers with full JSON export.

IP Purity (100) = 100 - Hosting(28) - Broadcast(8) - Proxy/VPN(22) - Tor(30) - DNSBL(n×18) Env Consistency(100) = 100 - TimezoneMismatch(30) - LangMismatch(15) - WebRTCLeak(35) - DNSLeak(20)

🔬 How IPGuard Audits IP Purity & Protocol Leaks in 3 Steps

Zero-backend client-side architecture powered by HTTPS CORS, DNS-over-HTTPS (DoH), and deterministic Web hardware APIs

01 · Simultaneous 4-Channel Exit Exposure

IPGuard starts step 1 of 3 steps on page load by probing Global Proxy, Domestic Direct, Cloudflare Edge, and WebRTC STUN UDP exits concurrently over HTTPS, exposing split-tunnel rules and real ISP addresses within 5 seconds with 0 bytes sent to any private server.
02 · Hosting vs. Native ASN & 10-Channel Leak Matrix

IPGuard cross-verifies IPinfo, ipapi.is, Team Cymru RIR records, and 5 DNSBL blacklists to distinguish datacenter hosting from residential ISPs, while testing 10 channels (IPv6, WebSocket, WebTransport, HTTP/3 QUIC, DNS Prefetch, Preconnect, Beacon) using unique subdomains.
03 · Protocol Fingerprinting & JSON Audit Export

IPGuard computes TLS JA3 hashes, post-quantum key exchange, HTTP header order, and SHA-256 hardware fingerprints across Canvas, WebGL, WebAudio, and system fonts in memory, storing 4 languages preferences in localStorage and exporting a 100% structured JSON report.

❓ Frequently Asked Questions & Risk Methodology (FAQ)

IPGuard answers key technical questions covering datacenter vs. residential ASN classification, Native vs. Broadcast IP verification, 10-channel WebRTC and DNS leak detection, TLS JA3 mismatches, and 0 bytes localStorage privacy.

How does IPGuard distinguish Datacenter/Hosting IPs from Residential ISP IPs?

IPGuard queries IPinfo, ipapi.is, ipwho.is, FreeIPAPI, and AliDNS DoH reverse PTR records concurrently over HTTPS, executing an 8-source voting algorithm on the ASN and organization name to flag 100% of known AWS, Vultr, Cloudflare, and VPS subnets within 5 seconds in JSON.

How does IPGuard verify Native IPs vs. Broadcast IPs purely in the browser?

IPGuard uses DNS-over-HTTPS (DoH) to query Team Cymru official asn.cymru.com TXT records, extracting the official RIR allocation country across ARIN, RIPE, and APNIC and comparing it with the GeoIP country across 4 languages to identify 100% Native vs. Broadcast IPs.

Why does IPGuard report WebRTC, IPv6, or DNS Prefetch leaks even when my proxy is enabled?

IPGuard tests 10 distinct network channels: when a proxy only intercepts IPv4 TCP traffic without a virtual TUN adapter, WebRTC STUN UDP, WebTransport QUIC, IPv6 AAAA connections, or dns-prefetch hints bypass the tunnel, which can be 100% fixed in 3 steps via TUN mode and Fake-IP.

Can proxying traffic through a remote server create TLS or HTTP header fingerprint mismatches?

IPGuard inspects TLS JA3 hashes, X25519MLKEM768 post-quantum groups, outbound HTTP header ordering, and TCP Connect vs. HTTP TTFB timing over HTTPS; if a middlebox terminates TLS or injects X-Forwarded-For headers, IPGuard flags the anomaly within 5 seconds in the JSON report.

Does IPGuard upload my real IP address, browser fingerprint, or scan history to any backend server?

IPGuard runs on a 100% client-side zero-backend architecture that uploads 0 bytes of telemetry to any private server; all SHA-256 fingerprint hashes for Canvas, WebGL, WebAudio, and fonts are computed locally in browser memory, saving only 4 languages settings in localStorage.