What this check looks at
Every website you visit receives a bundle of environment details from your browser: operating system, timezone, language, screen metrics, graphics renderer and more. Risk systems cross-reference these against your IP, looking for inconsistencies.
For example, an IP in the United States paired with an Asia/Shanghai browser timezone is one of the first contradictions risk systems check. Likewise, a user agent claiming to be a phone while exposing no touch support indicates the user agent has been spoofed.
What a WebRTC leak is
WebRTC is the browser feature behind real-time audio and video. To establish peer-to-peer connections it tries to discover the device's real network addresses. The problem is that it can expose your real IP to a website even while a VPN or proxy is active.
If the public address WebRTC reveals differs from the IP shown at the top of this page, your proxy is leaking — the site can see both your proxy address and your real one.
Virtual machine and automation traces
If the graphics renderer row shows names like SwiftShader or llvmpipe, the browser is using software rendering rather than a hardware GPU. That is characteristic of a virtual machine, container or headless browser, and rare on a real device.
The automation traces check looks for the flag browsers set when they are driven by automation tooling. When that flag is true, most risk systems block outright.