Weekly IP Intel #1: 1 in 7 Proxy Users Is Leaking DNS
From IPchase's week of anonymized detection data — 52.9% of visitors exit through datacenter IPs and the share keeps climbing, 14% have DNS mismatches, IPv6 sits at 6.1%. What the numbers mean and what to do about each.
This is the first edition of the IPchase Weekly IP Intel. Each week we pick the most telling movements from our anonymized aggregate statistics and unpack what's behind them. First, the methodology: all numbers come from anonymous aggregation of visitor-initiated tests. We only record network-layer traits — IP type, country, IPv6 share — and no fingerprint data of any kind. Fingerprints never leave the browser; that's a hard line. Sample window: October 16–22.
Number one: 14% of tests show a DNS mismatch
The sorest stat this week. One in every seven visitors who ran a full check had a DNS resolver exit that didn't match their HTTP exit.
The damage here is routinely underestimated. People verify their exit IP, align timezone and language, and call it done — but when the browser resolves a new domain, if that lookup still goes through the local resolver, "where you are" has already been disclosed before the first request fires. And plenty of anti-fraud systems compare resolver exit against access exit directly: a mismatch is a strong disguise signal on its own.
This is the classic DNS leak, and it flares up in two configurations: the proxy client tunnels browser traffic but not system DNS, or "smart routing" rules send some domains direct. The mechanics are covered in how DNS leaks work; the fastest verification is a DNS leak test — it resolves random subdomains against an authoritative server and compares the two exits in seconds.
If you're in the 14%: before blaming your provider, check the client config first. It's usually one toggle.
Number two: 52.9% exit through datacenter IPs, and rising
More than half of all tested visitors exited through a datacenter-type IP, up 1.7 points week over week. Residential sits at 43%, mobile at just 1.3%.
The high share isn't surprising — datacenter IPs are cheap, plentiful and fast, the natural first purchase. But they're the easiest class for risk engines to flag: the ASN ownership of hosting ranges is public, IP intelligence databases pre-tag them, no sophistication required. That's the gap between "same actions, datacenter IP gets limited, residential doesn't."
The +1.7pt rise means either new visitors skew datacenter-heavy, or existing users aren't upgrading their purchases with experience. Either way, the conclusion bears repeating: for anything involving account longevity, spend the budget on IP type, not IP quantity. How big the gap really is: residential vs datacenter IPs.
Number three: IPv6 penetration at 6.1%, slipping
The share of visitors exiting via IPv6 fell from 6.7% to 6.1%. The proxy context explains the low number: home broadband is mostly IPv6-native, but residential proxy nodes remain IPv4-dominant, while datacenter ranges have IPv6 to spare.
Why a casual user should care: if your connection has IPv6 but the proxy only handles IPv4, traffic can bypass the tunnel — some requests egress via your real IPv6, a subtler failure than a DNS leak. Same verification routine: run the IP check twice a few hours apart and watch for the exit flip-flopping between v4 and v6.
Visitor profile
Top countries this week: United States 33.1%, China 22.6%, Singapore 5.3%, then Germany and France. The mix matches the site's positioning — US nodes remain the mainstream choice for proxy users.
This week's action items
- Run a DNS leak test — a 14% baseline is high; don't assume you're in the other 86%
- On a datacenter IP? Evaluate whether residential is worth it, using the proxy purchase checklist
- On IPv6? Run the full check twice and confirm traffic isn't bypassing the tunnel
Data refreshes weekly. See you same time next week — or check your own exit type now on the IPchase homepage.
Check your own network: run a full disguise check on the homepage, or try the fingerprint test.