IP Intelligence Weekly #4: IPv6 Exit Share Rebounds to 7.8% — Watch for Dual-Stack Bypass

Issue four of the IPchase intelligence weekly. Methodology unchanged: anonymous aggregates produced when visitors run checks on the site, recording only network-layer traits — IP type, country, IPv6 share — and never any fingerprint information. Sample window: November 9–15.

One caveat up front: this window still straddles the DNS-metric switchover (new logic shipped on the afternoon of the 12th), so the first three days use the old counting. The DNS figures below become fully clean next week. IPv6 and datacenter shares are unaffected.

Number one: IPv6 back to 7.8%, up 2.7 points

This is the only clear move this issue. Across four consecutive weeks: 6.1% → 5.7% → 7.8%. The earlier dip is fully erased.

What makes it interesting is the direction relative to datacenter share, which fell from 56% to 54% this week. The IPv6 growth is not coming from datacenter traffic. So where is it from? Three candidates:

One, dual-stack defaults are spreading. More broadband and mobile networks hand out IPv6 addresses by default. Users don't opt in — it's a side effect of carrier network evolution.

Two, mobile networks have high IPv6 penetration. But mobile traffic is still 0.0% of visitors, so this can be ruled out as a main driver.

Three, proxy providers are starting to offer dual-stack exits. Some residential nodes now support both v4 and v6, raising the chance of hitting v6 during a check.

Why 2.7 points is a warning for proxy users

The IPv6 share itself isn't the problem. Dual-stack routing bypass is.

The typical scenario: your system uses an IPv4-only proxy. A target site publishes both A and AAAA records, and the browser prefers IPv6 — that request never touches your proxy, going straight out from your local network. The result:

• The site sees your real IPv6 address, not the proxy IP
• Within one session, some requests go through the proxy and some go direct, with the exit flipping between countries
• More subtly, DNS: v6 resolution may take a different path entirely

This leak is harder to notice than a DNS leak because page experience doesn't change — only comparing exits reveals it.

Our IPv6 privacy extensions piece covers address rotation as a privacy feature. For proxy users the only question that matters is: do your IPv6 requests actually go through the proxy?

How to check whether you're leaking

Two steps:

1. Open the homepage check and note whether the exit is IPv4 or IPv6
2. Check again a few seconds later and see whether the exit "flips" between v4 and v6 — alternation means both paths are live

If you are leaking, two directions: enable IPv6 support in your proxy client (tunnel v6 too), or disable IPv6 at the system/browser level (blunt but effective, at the cost of v6's connection-quality benefits).

For cross-border work there's a middle path: disable IPv6 only inside the proxy client while keeping it on the system — this requires per-rule routing support and slightly more configuration.

Number two: datacenter IPs at 54.0% — oscillating, structure unchanged

Datacenter share is 54.0%, down 1.0 point. Last five issues: 52.9 → 56.7 → 56.0 → 53.9 → 54.0 — a steady band between 53% and 57%.

Same conclusion as last issue: the visitor mix has settled, with more than half on datacenter exits. A one-point weekly swing is noise and shouldn't be over-read. The trend worth watching is residential share: 43.4% this week, slightly up.

Number three: confirmed DNS leaks 17.4%, public DNS usage 5.8%

First numbers under the corrected methodology. In short: one in six checks has DNS egress and HTTP egress genuinely in different countries; roughly one in seventeen visitors uses public anycast DNS, whose geography can't be judged and is excluded from the leak count.

How the measurement changed, and why "indeterminate" must be reported separately, is covered in this correction write-up — no need to repeat it. One emphasis: 17.4% is far more trustworthy than last week's 39%, but the rolling window still contains legacy counts; next week is the first fully clean version.

Countries: Singapore and France tie for third

Top five: US 35.8%, China 15.1%, Singapore 5.9%, France 5.9%, Germany 3.7%.

France has held a top-four spot for three consecutive issues, keeping European origin at the edge of double digits. The practical takeaway is unchanged: benchmark European routes instead of defaulting to the US.

This week's action list

1. If you run an IPv4-only proxy, run the full check twice and watch whether your exit flips — the single most useful action this week
2. For long-session work, confirm your client tunnels IPv6; if you don't need it, disable v6
3. When choosing nodes, benchmark one European route with the speed test, comparing on/off-proxy download deltas

Data updates weekly. To see your own exit type and location, the IPchase homepage displays it on load.