MITM Detection Tools

Client-side techniques to help identify potential Man-in-the-Middle attacks.

Detection Results

Running security checks... ⏳

Server-Reported Information

This data comes from the server and represents what the server sees about your connection:

  • Your IP Address: 216.73.216.36
  • Host Header: crl.cryptoagility.cloud
  • HTTPS Status: Yes ✅
  • Protocol: HTTP/2.0
  • User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

Detection Methods Explained

IP Address Mismatch Detection

Uses WebRTC to discover your real IP addresses (including local network IPs and both IPv4/IPv6) and compares them with the IP address the server sees. A mismatch may indicate:

  • VPN or proxy usage (legitimate)
  • Corporate network gateway
  • Potential MITM proxy
  • Dual-stack networks: If you have both IPv4 and IPv6, the server might use one while WebRTC discovers the other. This is normal and not a security concern.

Limitations: Many browsers block WebRTC IP leaks for privacy. VPNs legitimately cause mismatches.

Certificate Transparency Monitoring

Checks if the website's SSL certificate is logged in public Certificate Transparency logs. MITM attackers using self-signed or rogue certificates typically cannot add entries to CT logs.

Limitations: Requires external API access. A sophisticated MITM could potentially use a legitimately-issued certificate for the same domain (via compromised CA or domain validation hijacking). Corporate SSL inspection uses legitimate certificates that may be in CT logs. This check verifies certificate transparency compliance, not certificate authenticity.

Geolocation vs IP Location

Compares your browser's geolocation with the geographic location of your IP address. Large discrepancies may indicate VPN or proxy use. Requires user permission - if denied, this check is skipped.

Limitations: Requires location permission (often blocked for privacy). VPNs and mobile networks legitimately cause large mismatches. IP geolocation databases have varying accuracy (typically city-level at best). Browser geolocation uses GPS/WiFi positioning which can differ from ISP location.

Latency Analysis

Measures round-trip time to the server. Unusually high latency or high variance may indicate traffic routing through a proxy. Multiple measurements are taken to detect inconsistent routing patterns.

Limitations: Network conditions vary significantly by region (e.g., Australia-Europe connections can have 300-400ms normal latency). CDNs, edge servers, mobile networks, and WiFi congestion all affect measurements. Threshold is set at 1000ms to account for regional differences.

DNS Resolution Verification

Checks if the domain resolves to the expected IP addresses using public DNS resolvers. Queries both A (IPv4) and AAAA (IPv6) records to verify DNS integrity.

Limitations: DNS can be legitimately overridden (hosts file, corporate DNS, Pi-hole). CDNs and load balancers often return multiple IPs, and your connection may use any one of them. A mismatch doesn't necessarily indicate MITM - it's normal for CDN-backed sites. DNS hijacking attacks could still pass this check if they control authoritative DNS.

Understanding Results

These checks provide indicators, not proof. Common legitimate scenarios that trigger warnings:

  • Corporate Networks: Often use SSL inspection proxies for security monitoring
  • VPN Services: Route traffic through different IP addresses and locations
  • Privacy Tools: May block WebRTC or location access
  • Mobile Networks: Use carrier-grade NAT causing IP mismatches

True MITM attacks require investigation beyond these automated checks. If you suspect compromise, verify the SSL certificate manually and contact your network administrator.