Your HTTP traffic rides the TCP path through the proxy, so the target page logs the proxy's IP. But WebRTC fires a STUN request over UDP that skips the proxy entirely, and the reply, your real public IP, lands in the ICE candidates any page script can read. Flip on webrtc_leak_protection to block the non-proxied UDP.
TCP / HTTP · through proxy
UDP · STUN · bypasses proxy
your machine · OS network stack
pydoll
your Chrome
real IP 189.6.44.12
HTTP proxy
74.63.201.8 · TCP only
target page
logs proxy IP
STUN server
stun.l.google.com
:19302
proxy carries no UDP
non-proxied UDP blocked
target page logs (HTTP) 74.63.201.8 proxy exit IP · masked the HTTP proxy works. the leak is elsewhere.
ICE candidatespc.onicecandidate gathering…
webrtc HTTP via proxySTUN over UDP
Host candidates are Chrome's ephemeral mDNS names (a1b2c3d4.local), so the LAN IP is mostly hidden by default. The server-reflexive (srflx) candidate is the one that leaks. Always verify with browserleaks.com/webrtc or ipleak.net that only the proxy IP appears.