Your HTTP traffic rides the TCP path through the proxy, so the target page logs the proxy's IP. But WebRTC fires a STUN request over UDP that skips the proxy entirely, and the reply, your real public IP, lands in the ICE candidates any page script can read. Flip on webrtc_leak_protection to block the non-proxied UDP.
TCP / HTTP · through proxy
UDP · STUN · bypasses proxy
your machine · OS network stack
pydoll your Chrome
real IP 189.6.44.12
HTTP proxy
74.63.201.8 · TCP only
target page
logs proxy IP
STUN server
stun.l.google.com :19302
proxy carries no UDP
non-proxied UDP blocked
target page logs (HTTP)74.63.201.8proxy exit IP · maskedthe HTTP proxy works. the leak is elsewhere.
ICE candidatespc.onicecandidategathering…
webrtcHTTP via proxySTUN over UDP
Host candidates are Chrome's ephemeral mDNS names (a1b2c3d4.local), so the LAN IP is mostly hidden by default. The server-reflexive (srflx) candidate is the one that leaks. Always verify with browserleaks.com/webrtc or ipleak.net that only the proxy IP appears.