Whoer.net: How to Read It Properly, and What It Cannot Tell You

Whoer.net is the page you open when you want to know what you are leaking. It loads, it shows you an IP, a flag, a percentage, and a column of green and red rows.

Most people read the percentage and close the tab. That is the least useful number on the page.

Here is what each part is actually telling you, which rows matter, and the one failure it catches that nothing else will.

Start with what whoer is

Whoer is a mirror. It receives your connection and reports back what your connection revealed about you. That is the whole job.

It does not know your account history. It cannot see how many other people have used your IP this week. It has no relationship with Instagram or Cloudflare and no insight into what they think of you.

So when someone says "whoer gives me 100%, why did I still get banned", the answer is that those two things were never connected. Whoer measured consistency. The platform measured reputation and behaviour. Different questions.

The trust score is an opinion, not a verdict

The percentage is whoer's own composite of a handful of checks: does your DNS location match your IP location, is a proxy header detectable, is WebRTC exposing anything, does your time zone line up.

That is genuinely useful as a summary. It is not a ban predictor, and treating it as one leads people to strange decisions.

I have watched someone abandon a perfectly good mobile IP because it scored 78%, and pick a datacenter IP that scored 95%. The datacenter address was in a published hosting range that half the internet blocks on sight. The mobile one was fine. The score measured tidiness; it could not measure reputation.

Read the rows. Ignore the headline.

The rows that matter, in order

DNS — the one people skip

This is the most valuable line on the page and it gets the least attention.

Your traffic and your DNS lookups travel separately. It is entirely possible, and very common, for your requests to exit through a proxy in Chicago while your DNS queries go to your home ISP in Warsaw. Whoer shows both, and that gap is what people are seeing when they say "it still shows my real country".

Two things go wrong when DNS leaks. The obvious one is privacy: whoever runs that resolver sees every hostname you visit. The less obvious one costs you more. Large sites route you to the edge server nearest your resolver, not your IP. Leak your real DNS and a CDN quietly sends you to the wrong edge, which produces slow connections and the maddening pattern where a site works, then does not, then works again.

Fix: make the proxy resolve hostnames instead of your machine. With SOCKS5 that is the difference between socks5:// and socks5h://. The h is doing all the work, and it is the single most common configuration mistake in this entire category. More detail in DNS leaks.

IP and ASN

Whoer shows the address and who owns it. What matters is the classification, not the number.

An address in a range registered to a hosting company is identifiable as such by anyone who cares to look, because those ranges are published. A carrier address sits behind CGNAT with a large number of ordinary phone subscribers, which makes blocking it expensive for a platform. That is the entire reason mobile IPs score differently, and whoer will show you which one you have.

WebRTC

WebRTC finds the best path between two browsers, and to do that it enumerates addresses. Sometimes it enumerates one you did not want shared.

A 192.168.x.x result is your local network and is completely normal. Every browser shows it. The result that matters is your real public IP appearing while a proxy is active, which means WebRTC found a path around the tunnel. That is a genuine leak. More here.

Do not fix this by disabling WebRTC. Absence is itself unusual, because ordinary Chrome has it. Anti-detect browsers offer a "replace" mode, and that is the right setting.

Time zone, language, screen

These come from your computer, not your connection. Whoer will flag a US address paired with a European clock, and it is right to.

Your proxy provider cannot fix this. Nobody's can. It is a browser-layer problem and it is exactly why anti-detect browsers exist. If you are running multiple accounts and have not addressed it, the IP is not your weakest link.

The leak we shipped ourselves

Worth telling because it is the argument for actually running these tests instead of assuming.

We had a DNS leak across the fleet. Traffic was exiting correctly, through the phone, over the carrier's network, exactly as it should. But hostname resolution was happening on our relay infrastructure rather than on the device. So DNS reflected a datacenter while the traffic reflected a mobile carrier.

Two things about that are worth sitting with.

A proxy can be exiting from precisely the right place and still leak. The traffic path and the DNS path are separate. Getting one right tells you nothing about the other.

No monitoring caught it. Every dashboard was green. Every "what is my IP" check returned the correct mobile address, because the exit really was correct. The bug only became visible when somebody ran an actual leak test and read the DNS row.

We moved resolution onto the device. Leak tests now show the carrier, which is what a real mobile connection should look like.

I would rather write that down than pretend it did not happen, because it is the whole case for the tool. If we had trusted our own monitoring instead of a leak test, that bug would still be live.

What whoer cannot see

Being clear about the limits, because people over-read this page:

• IP reputation. Whether your address has been used to hammer somebody's login endpoint for a fortnight. Whoer has no idea, and it matters more than everything whoer does measure.
• Behaviour. Request rate, timing patterns, how human your session looks.
• Account history. Age, prior flags, phone verification, what the platform already associates with you.
• TLS fingerprint. Your client's handshake signature, which is how a lot of automated traffic gets identified before a single header is read.

A perfect whoer result and a badly-behaved script will still get you blocked. The page can only report what your connection said about itself.

A two-minute routine

Run this against any provider before you commit to them:

1. Open whoer with the proxy off. Note your real IP, DNS and country. That is your control.
2. Turn the proxy on. Reload.
3. Check the IP changed and the DNS moved with it. If DNS still points home, you have a leak and it is a configuration problem, not a provider problem, about 90% of the time.
4. Check WebRTC is not showing your real public address.
5. Check the ASN. If you paid for mobile, it should be a carrier, not a hosting company.

Step 3 is where most setups fail, and it is the step people skip.

When the proxy itself is the problem

Most whoer disappointments are configuration. Some are not.

If DNS resolves on the device, the exit shows a real carrier, and results still look wrong, the questions worth asking a provider are narrower:

Is the address dedicated to you? On a shared pool you inherit whatever the previous user did with it. That is invisible on whoer and it is frequently the actual cause of everything else.

Can they prove a rotation worked? Most providers report success when the device accepts the rotate command, not when a new address appears. Those are different events. A rotation returning success in about two seconds did not change your IP; a real one takes closer to six, because the radio has to detach and re-attach. Full method here.

Does "online" mean anything? Most dashboards report a heartbeat. A phone can answer heartbeats perfectly while its radio is dead.

We run dedicated 4G/5G devices on US carrier SIMs, one tenant per device, and we record the exit IP on every rotation so a rotation that did not work is visible instead of hidden behind a success flag.

Two honest limits. A clean whoer result does not make you undetectable, because whoer cannot see the things that get most people caught. And we are IPv4-only. Some competitors egress IPv6, and on certain checkout and checkpoint flows that is a real advantage we do not currently have.

If detection is not your constraint and you just need throughput, buy datacenter proxies. They are faster and cheaper and this whole page is irrelevant to you.

Frequently asked questions

What is a good whoer trust score?

There is no threshold that means anything. The score is whoer's own consistency check, not a rating any website you visit will ever see. A 100% score with a heavily-used shared IP is worth less than a 70% score on a clean mobile address. Read the individual rows instead.

Why does whoer show my real location with a proxy on?

Almost always DNS. Your traffic goes through the proxy while your DNS queries go somewhere else, usually your ISP's resolver. Whoer reports both, and the mismatch is what you are seeing. Fix it by making the proxy resolve hostnames rather than your own machine.

Does whoer tell me if I will get banned?

No, and this is the most common misreading of it. Whoer measures what your connection discloses. Platforms score you on IP reputation, behaviour, account history and device fingerprint, most of which whoer cannot observe at all.

My WebRTC shows a 192.168 address. Is that a leak?

No. That is your local network address and every ordinary browser exposes it. The leak worth worrying about is when WebRTC reveals your real public IP while your traffic is going through a proxy.

Whoer says my time zone does not match my IP. Whose fault is that?

Yours, not the proxy's. Time zone, screen resolution and system language come from your computer. A US proxy with a European clock is a contradiction, and no provider can fix it from their end. Anti-detect browsers exist to handle exactly this.

Is whoer.net accurate?

For what it measures, generally yes. The IP, DNS, WebRTC and header data are straightforward observations. The trust percentage is a judgement call layered on top, and that part is worth far less than the raw rows beneath it.