WebRTC reveals a datacenter machine hidden behind a non-datacenter connection
net.datacenter_origin_proxied · convicts
What it catches
The cross-layer thesis applied to IP reputation: the REAL machine running the browser is in a DATACENTER (WebRTC-leaked srflx origin classifies datacenter) yet it CONNECTS through a NON-datacenter (residential) IP (observed_ip classifies not-datacenter) — a datacenter machine HIDING behind a residential proxy. This is the dominant commercial-scraping pattern (a cloud VM on AWS/GCP fronted by a residential proxy pool) that defeats observed_ip reputation: rep.datacenter_asn sees only the clean residential proxy. The detector derives network.datacenter_origin_proxied in _with_derived when webrtc_public_ip is datacenter AND observed_ip is NOT datacenter. CONVICTING (coherence) where the sibling rep.webrtc_origin_datacenter is only corroborating, because the extra observed_ip not datacenter clause removes the one real FP: a cloud-desktop / remote-browser user (browser on a cloud VM) connects DIRECTLY from the datacenter, so their observed_ip is ALSO datacenter → this rule does NOT fire on them (they are caught corroboratively by rep.datacenter_asn instead). A datacenter machine connecting via a residential IP has no legitimate explanation — only a bot hides a cloud VM behind a residential proxy. A real VPN user leaks their RESIDENTIAL home origin (not datacenter) → never fires. GROUNDED LIVE 2026-06-20 (iter-34): local STUN reporting 52.0.0.1 (committed AWS CIDR) + an HTTP CONNECT proxy → camoufox observed_ip = clean proxy (not datacenter), webrtc_public_ip = 52.0.0.1 (datacenter) → this rule FIRED (label bot) while rep.datacenter_asn did NOT. browserforge/intoli calibration carry no WebRTC layer so this never fires there; a real cloud-desktop-direct user (observed_ip datacenter) is unit-tested to NOT fire it.
Signals it reads
network.datacenter_origin_proxied
How it fires
present
Evaders it caught 2
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.