A browser can fake its WebRTC address — it can't fake the packet

Every WebRTC leak check reads a value the browser reports, and an anti-detect browser reports whatever keeps you happy. So I stopped reading its answer and started checking mine: run the STUN server yourself, and whether a packet actually arrived becomes the one thing the browser can’t forge. Here’s the idea, a widget to test your own browser, and an honest tour of everywhere it fails.

July 22, 2026 · 8 min · Vitalii Zaiats

The extra hop: counting a visitor's NAT layers from the outside

A NAT is a router that subtracts one from the TTL, so every NAT layer is a hop you can count. I built a small tool that reverse-traces a visitor back through the hole their own connection punched — and asked the honest question: is any of it useful for catching bots? Mostly no, sometimes cheaply yes.

July 15, 2026 · 10 min · Vitalii Zaiats