Why IPCombo uses cdn-cgi/trace to get per-target exit IPs

Traditional IP checkers (ifconfig.me, ipinfo.io, ip.sb) return one IP — the one closest to you on the network path. If you have a proxy with smart routing, that's typically your proxy exit, not your home IP. But it doesn't tell you *which* rule fired.

Was the proxy rule for Google 'go direct'? Then the IP you see for the IP check is your real IP. Was it 'proxy through SG'? Then it's your SG exit. Was it 'proxy through US for the US, but direct for the US if the site is whitelisted'? The single-IP answer doesn't help you figure any of this out.

Cloudflare operates a diagnostic endpoint at https://<any-cloudflare-site>/cdn-cgi/trace. It returns plain-text key=value pairs including the source IP of the request as seen by Cloudflare's edge. Since Cloudflare serves a third of the web, most of the sites IPCombo tests are already on Cloudflare — and the diagnostic endpoint is free, unauthenticated, and has no rate limit.

What we get back: the IP of whoever made the request, the country, the colo (Cloudflare's data center code), the TLS version, and a few other diagnostics. Because each request goes to a *different* Cloudflare site, we get a different edge IP per target — and a different source IP if the proxy has per-domain rules.

We can show, for each target in the matrix, the actual IP your request exited from. If 'google.com' shows your real home IP and 'openai.com' shows your proxy exit, you've confirmed that your proxy is whitelisting Google but proxying OpenAI. This is the kind of evidence no other public IP checker gives you.

For non-Cloudflare targets, we fall back to the per-request image probe and infer the exit from latency + WebRTC shape. The inference isn't as precise, but it's still much better than a single-IP answer.