# Proxy shows an IPv4 and an IPv6 address? One exit

> A proxy that shows both an IPv4 and an IPv6 address is a dual-stack exit. Sites see either one, so look both up before you trust the location.

Source: https://mosaicbrowser.com/blog/dual-stack-proxy-two-addresses

## An IPv4 and an IPv6 address from one proxy is one exit

A proxy that shows both an IPv4 and an IPv6 address is a dual-stack exit. Sites see either one, so look both up before you trust the location.

![Two address families, one exit, beside a screenshot: a proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/covers/dual-stack-proxy-two-addresses.webp)

A proxy that shows an IPv4 address and an IPv6 address is almost always one exit with two address families. The household or network at the other end has an IPv4 address and an IPv6 prefix, and every connection that leaves through it goes out by one or the other. A checker page that tests both families prints both lines. Nothing has rotated and nothing has leaked, as long as neither address is your own.

We got this wrong in our own proxy check before we got it right, and the mistake is a good map of what the two lines do and do not tell you.

## Why one proxy shows two addresses

When Chrome uses an HTTP or SOCKS5 proxy, it does not resolve the website's hostname itself. It hands the name to the proxy, and the proxy's exit looks it up and connects. So the exit, not your browser, decides whether the connection goes over IPv4 or IPv6, based on which records the website publishes and what the exit's own network prefers.

Checker pages that show both lines usually do it on purpose. They make one request to a hostname that only has an IPv4 record and another to one that only has an IPv6 record, and print what each saw. On a dual-stack exit both succeed.

A general-purpose site is different. If it publishes both kinds of record, the exit can reach it either way, and two connections a minute apart are allowed to differ. If it publishes only IPv4, it only ever sees the IPv4 address.

Mosaic is a desktop app

Email yourself the link and open it on your computer.

[How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers)

## The check that called a sticky session a rotating pool

Mosaic's proxy check samples the exit twice: a location lookup over plain HTTP and a tunnel probe over HTTPS to a different service. It does that so a rotating endpoint gives itself away, because two different addresses from two requests a second apart usually mean the gateway handed out a new exit.

On one dual-stack residential exit the two requests left by different families. With the real addresses swapped for documentation ranges, the check saw this:

```
location lookup (HTTP)   203.0.113.44
tunnel probe   (HTTPS)   2001:db8:7c3e:5dc4::d565

```

The comparison was a string inequality, so it said the exit had moved. It said so three checks in a row, while both addresses stayed the same in every check. The reputation report built on top of it then told the operator their sticky session was "one sample of the pool" and suggested pinning a session that was already pinned. The longer write-up of that report is in [scoring a rotating proxy scores one draw from the pool](https://mosaicbrowser.com/blog/rotating-proxy-reputation-sample).

The fix lives in one function, `exitMoved` in `src/main/proxy/check.ts`:

```
function exitMoved(a?: string, b?: string): boolean {
  if (!a || !b) return false
  const family = (ip: string): 4 | 6 => (ip.includes(':') ? 6 : 4)
  if (family(a) !== family(b)) return false
  return a !== b
}

```

An IPv4 address and an IPv6 address cannot be compared, so they are not evidence that the exit moved, and they are not evidence that it stayed put either. Only two addresses of the same family that differ count. It is the same rule the check already applied to a gateway that times out once: no answer is not a measurement.

## What the two lines tell you, and what they don't

Read the pair the way the check now does.

| What you see | What it means |
| --- | --- |
| One IPv4, one IPv6, neither yours | one dual-stack exit |
| Two different IPv4 addresses from one sticky session | the session rotated or expired |
| An IPv6 address that shares a prefix with your own | something went around the proxy |

For the third row, check your own connection with the proxy off and compare the first four groups of the IPv6 address. When the leak is real, the usual culprit is WebRTC, which gathers candidates over UDP that an HTTP proxy never carries; [the WebRTC IPv6 candidate](https://mosaicbrowser.com/blog/webrtc-ipv6-candidates) has how that happens and what blocking non-proxied UDP does to it. A rotation by hand is easier to spot on one checker asked twice, comparing IPv4 with IPv4, which is the method in [one exit, not two](https://mosaicbrowser.com/blog/two-ip-addresses-one-exit).

## Look up both halves before you trust a location

The part people skip is that the two addresses of one exit are two rows in a geolocation database, sourced and updated separately. They often agree. When they do not, a site that reached you over IPv6 places you somewhere other than the site that reached you over IPv4.

That matters for a profile, because Mosaic draws a profile's timezone, language and geolocation for its proxy's measured exit, and a measurement is one lookup of one address. In the case above the location lookup answered for the IPv4 address. So before you keep an exit for an account, look up both addresses in the same database. If they agree on the country and roughly on the city, the exit is consistent from either side. If they disagree by a country, that exit tells two sites two different stories, and a new session is cheaper than explaining it later.

Reputation works the same way. A blocklist hit on the IPv4 address says nothing about the IPv6 prefix, and the reverse. [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it) goes in the order we use: does it answer and tunnel, where does it really exit, is the address any good, and does the browser stay behind it.

## Questions

### Why does my proxy show both an IPv4 and an IPv6 address?

Because the exit has both. A home connection that is dual-stack has one IPv4 address and an IPv6 prefix, and each new connection through the proxy leaves by whichever family the exit's network picks for that destination. A checker page that tests both families prints both.

### Which address does a website see?

Whichever family the connection to that website used. A site that publishes only an IPv4 address always gets the IPv4 one. A site that publishes both can get either, and the choice is made at the exit, not in your browser, because an HTTP or SOCKS5 proxy resolves and connects on your behalf.

### Is an IPv6 address on my proxy check a leak?

Only if it is yours. Compare it with the IPv6 address your own connection shows without the proxy. If they share a prefix, a request went around the proxy; if not, it belongs to the exit.

### Should I check the location of both addresses?

Yes. Geolocation databases place IPv4 and IPv6 addresses separately, so the two halves of one exit can come back in different cities. Look both up in the same database before you match a profile's timezone and language to either.

## Related

[IPv4 from one probe, IPv6 from the other: one exit, not two](https://mosaicbrowser.com/blog/two-ip-addresses-one-exit): A proxy that shows an IPv4 address on one checker and an IPv6 address on another is usually one dual-stack exit. Rotation only shows within one family.

[Scoring a rotating proxy scores one draw from the pool](https://mosaicbrowser.com/blog/rotating-proxy-reputation-sample): A reputation check on a rotating proxy scores whichever exit the pool handed out that second. Pin a sticky session to score the address you will browse from.

[WebRTC and IPv6: the candidate your proxy never carried](https://mosaicbrowser.com/blog/webrtc-ipv6-candidates): A WebRTC IPv6 leak is a candidate gathered over UDP that an IPv4 proxy never sees. Blocking non-proxied UDP closes it for both address families at once.

[How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it.

[Provider accounts: one gateway line, one exit per profile](https://mosaicbrowser.com/features/proxy-providers): Paste your proxy seller's gateway line once and Mosaic mints a separate session for every profile, so each one browses from its own exit address.



[What happens to QUIC when Chrome has a proxy](https://mosaicbrowser.com/blog/chrome-quic-through-a-proxy): With an HTTP, HTTPS or SOCKS5 proxy set, Chrome reaches sites over TCP tunnels, so a page that gets HTTP/3 direct gets HTTP/2 through the proxy.



## Mosaic, on your own computer

The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number.

Mosaic is a desktop app

Email yourself the link and open it on your computer.