WhoerIP.com alternatives: other IP and leak checkers, and where its tests send you (2026)

WhoerIP.com is a free IP checker whose name people search about 5,400 times a month, and its pages name no company. We read the code of its tools on 14 October 2026. Its DNS leak test looks up names on the domain of the Pixelscan checker, pixelscan.net. Its VPN checker and WebRTC test are set to report to an Amazon server that shows a certificate for apple.pixelscan.net. The WebRTC test also asks a relay server whose address is registered to ThreatMetrix Inc., a company that scores the risk of logins and payments. Its IP lookup and blacklist check answered every try that morning with an error. For each WhoerIP tool, the table below names another checker that does the same job.

What WhoerIP offers, and what each check runs on

WhoerIP's menu lists eight tools: the home page with your address and four verdicts, an IP lookup, a blacklist check, a VPN checker, a DNS leak test, a WebRTC leak test, a speed test and a cookie converter. The site runs on WordPress at the web host Hostinger. We read the script and settings of each tool from our server and followed every address they name.

The speed test is the plainest case, and it runs on Cloudflare's network. Its script says it is "using Cloudflare's speed test endpoint": it downloads test files from speed.cloudflare.com and uploads to the same host. If none of its ten pings gets through, the page shows a ping of 50 ms and a jitter of 10 ms, two numbers the script calls "Fallback values". The cookie converter turns cookies from JSON, Netscape or cURL format into one of the others inside your browser, and its script sends no request at all.

The IP lookup shows an address's country, city, coordinates, time zone, ISP and domain, with no VPN or proxy verdict. We asked it about three public addresses: Google's resolver 8.8.8.8, Cloudflare's 1.1.1.1 and a Tor exit relay. At every try between 07:22 and 08:13 UTC it answered "Invalid JSON from remote" with status 502, an error WhoerIP's own server gives about a service behind it. The blacklist check promises "20+ DNSBLs and reputation services" and gave the same answer at each try, so we could not see which lists it asks. Its page says "WhoerIP.com does not own or manage any of the listed blacklists", and its FAQ points readers to "online tools such as MXToolbox".

Its verdict counts lists, and every list weighs the same. The script turns the share of lists that name your address into a percentage: under 26% the page says "Your IP is almost clean" in green, and only above 49% does it say "We noticed you are on a blacklist". With 20 lists, an address found on one of them reads as 5% and almost clean. The same page warns that a listing "can break email delivery, lock server access, or take your site offline".

What WhoerIP's VPN score counts

The VPN checker shows two scores out of 100, one for VPN and one for proxy. Its script gives every test an equal share: six tests make up the VPN score, about 17 points each, and nine make up the proxy score, about 11 points each. When the lookup behind it lists the address as a VPN, the script adds 60 points to the VPN score, and it adds 60 to the proxy score for an address listed as a proxy. Up to 20 reads "Low Risk", up to 50 "Medium Risk", and anything higher "High Risk".

Some tests count one answer twice. "IP on VPN List" and "VPN Exit Node Enumeration" both read the lookup's VPN flag. In the script, the test called "HTTP headers test" takes the same proxy flag as "IP on Proxy List". The "Mobile" test adds 11 points to the proxy score whenever the lookup marks an address as mobile, so a phone on mobile data can start above zero.

The flags come from two sources, and a flag counts when either source raises it. The first is that Amazon server, which a browser refuses (more on it below). The second goes through WhoerIP's own site, and a comment in its code says it "uses ipwhois.pro". The nine flags carry the same names as the nine that ipapi.is lists for its own API, from is_abuser to is_vpn. We sent both requests from our own server, a rented machine in a US data center. The second source flagged it as a datacenter address and nothing else, which by the formula gives a proxy score of 11, Low Risk. WhoerIP's home page, asked from the same server, showed "Undetected" for VPN, Tor, proxy and anonymity.

A relay address registered to ThreatMetrix

WhoerIP's WebRTC page warns that "WebRTC sends direct UDP requests to STUN servers that expose your real home ISP IP." Its own test sets up two servers. One is Google's STUN server. The other is a relay, turn:aa.online-metrix.net, with the user name "1:null:null". When the test runs, the browser sends a request to each of them.

ARIN, the registry for internet addresses in the US and Canada, lists the relay's address, 192.225.158.2, in a block held by ThreatMetrix Inc. of Santa Clara. RELX agreed to buy ThreatMetrix in January 2018 for £580m, and described its technology as one that "analyses connections among devices, locations, anonymised identity information and threat intelligence" to "identify high-risk digital behaviour and transactions in real time". The release said ThreatMetrix would join the business that, under the LexisNexis Risk Solutions brand, "addresses fraud and authentication challenges".

Neither WhoerIP's WebRTC page nor its privacy policy names ThreatMetrix. Its about page says "we do not run honeypots for anti-fraud companies". We cannot see what the relay does with the requests it receives. Pixelscan's main script contains the same relay line, with the same user name. Our own WebRTC test, for comparison, asks two STUN servers, Cloudflare's and Google's, and no relay.

Where WhoerIP and Pixelscan meet

The DNS leak test's settings give "pixelscan.net" as its base domain. Your browser loads tiny images from names such as 1.pxlscndns(number).sub.pixelscan.net, and WhoerIP's site then reports which DNS servers looked those names up. The VPN checker's settings call their main endpoint a "Direct endpoint to backend (like WebRTC checker does)". Both point to an Amazon load balancer in Ireland whose address starts with the word whoerip. Asked on 14 October, that load balancer showed a certificate for apple.pixelscan.net, issued by Amazon on 30 September 2026.

A browser refuses a server whose certificate carries a different name, so in a visitor's browser this request fails before anything is sent. Our server's request failed the same way. Sent under the name apple.pixelscan.net, the certificate checked out and the load balancer answered 503, "Service Temporarily Unavailable". In practice the second source, through WhoerIP's own site, carries the VPN check.

Neither site names a company. Pixelscan's app terms are governed by the laws of Portugal, as our Pixelscan comparison sets out. WhoerIP's first archived page with content, of April 2025, listed Pixelscan among the tools it recommended, next to BrowserLeaks and CreepJS.

What WhoerIP says about your data

The about page is firm: "We do not collect or resell your data. Ever." It adds "We don't track you. We don't monetize your data", and says the site operates through "contributions, partnerships, and optional certifications". Its values list "Independence", described as "We are not affiliated with ad networks, anti-fraud systems, or surveillance tools."

The privacy policy lists what the site collects, starting with "IP address and browser fingerprint data", then device details, DNS server, time zone, language and "proxy or VPN status". It says "We store technical data such as IP addresses and browser fingerprints to help us improve test quality and detect edge cases." When it shares that data with "select partners (such as web automation or antidetect browser developers)", the policy says the data is "strictly anonymized". Usage is measured with Google Analytics. Its tool pages carry "Special Deals" for Multilogin, at 50% off any monthly plan, NodeMaven, at 35% off, and GeeLark.

WhoerIP on the record

The name echoes Whoer.net, an older checker with its own VPN and browsers, which we covered in our Whoer comparison. Their registry records differ: whoer.net was registered in November 2008 through NameCheap, and whoerip.com in October 2024 through GoDaddy. In October 2026 Keyword Planner counted 550,000 searches a month for "whoer", 27,100 for "pixelscan" and 5,400 for "whoerip".

Other checkers, by tool

Speed and blacklists: go to the source

Cloudflare's speed test at speed.cloudflare.com is "Powered by Cloudflare's global edge network", and its servers are the ones WhoerIP's test measures against. For blacklists, MXToolbox says its check "will test a mail server IP address against over 100 DNS based email blacklists", where WhoerIP promises "20+". Spamhaus runs the lists it is known for, ZEN among them, and offers its "Blocklists via DNS Query" free. Our guide on how to check if an IP is blacklisted walks through a lookup step by step.

DNS and WebRTC leaks

At dnsleaktest.com, the privacy policy is that of IVPN Limited. Mullvad's "Connection check" is the leak test of Mullvad VPN, under its menu item "Check for leaks". BrowserLeaks tests WebRTC on its own page and says "This website does not collect personal data, store user fingerprints, or set non-essential cookies."

VPN and proxy flags: read them raw

ipapi.is publishes the flags its API returns, is_vpn, is_proxy, is_tor, is_datacenter and five more, and these are the names WhoerIP's checker reads. ipinfo.io's free lookup page shows hosting, VPN, proxy, Tor, relay and residential proxy flags for any address. For a fraud score with prices beside it, our IPFighter comparison covers Scamalytics and IPQualityScore.

Where HProxy fits

We sell proxies and run free checks of our own: an IP lookup, a proxy leak test for WebRTC, IPv6 and forwarding headers, a WebRTC leak test and a proxy speed test. Residential traffic from us is billed at $0.50 per GB, with no plan, for HTTP and SOCKS5 alike.

Which one to pick

• speed.cloudflare.com for a speed test on the very servers WhoerIP's test uses.
• MXToolbox for a blacklist check across more than 100 lists, and Spamhaus for its own lists.
• dnsleaktest.com or Mullvad's connection check for DNS leaks.
• BrowserLeaks for WebRTC, or our WebRTC leak test, which asks STUN servers only.
• ipapi.is or ipinfo.io to see the flags behind a VPN verdict.
• WhoerIP's cookie converter if you need one: it converts inside your browser.

What we could not find out

WhoerIP's IP lookup and blacklist check failed at every try on 14 October 2026, from 07:22 to 08:13 UTC, so we could not see the service behind them or which lists the check uses. We do not know who runs WhoerIP or Pixelscan, since neither names a company. We cannot tell what the ThreatMetrix relay does with the requests it gets, or whether the Amazon load balancer served WhoerIP's checks before its certificate of 30 September 2026. We ran no test in a browser: we read each tool's script and sent its requests from our server. We plan to look at WhoerIP again by 14 January 2027, after the end of its registration term on 27 October 2026.

Sources

• whoerip.com: home, about, privacy policy, blacklist, VPN checker, DNS leak, WebRTC, speed test and cookie converter pages, their scripts (ip-lookup.js, ip-blacklist.js, vpn-check.js, dns-leak.js, speedtest.js, cookie-converter.js) and settings, and its lookup and blacklist answers, read from our server on 14 October 2026.
• The certificate and DNS records of the load balancer WhoerIP's checks call; ARIN's record of 192.225.158.2; the RIPE record of the address that serves whoerip.com; Verisign's registry record of whoerip.com, 14 October 2026.
• whoerip.com in the Internet Archive, December 2021 and April 2025 copies.
• pixelscan.net: its partners page and main script, 14 October 2026; its privacy policy and app terms as read for our Pixelscan page, 12 October 2026.
• RELX's release "RELX Group announces definitive agreement to acquire ThreatMetrix", 29 January 2018.
• speed.cloudflare.com, MXToolbox's blacklist page, Spamhaus's blocklists page, Mullvad's connection check and ipapi.is's API documentation, 14 October 2026; dnsleaktest.com and BrowserLeaks, read for our Whoer page on 12 October 2026; ipinfo.io's lookup page, read for our IPFighter page on 14 October 2026.
• whoer.net's registry record, 12 October 2026; worldwide search counts from Keyword Planner, 12 October 2026.
• HProxy's price, taken from our live price data; our WebRTC test's settings in our site's code.