host candidates use an mDNS hostname rather than a literal LAN address
Check id webrtc-mdns-host
What an ordinary browser yields
Host candidates carry randomised mDNS .local hostnames rather than literal LAN addresses — the default in every current major browser.
What a detector infers
When WebRTC enumerates the ways a peer might reach you, it offers host candidates describing your machine's own network interfaces. Historically that meant publishing the literal LAN address — 192.168.x.x, 10.x.x.x — to any page that asked, which let a site map the internal network of everyone who visited. Chrome, Firefox and Safari now all default to replacing that address with a random multicast-DNS hostname ending in .local: unique per origin, meaningless outside the local segment, and still sufficient for a real peer to connect. The check counts host candidates and asks which form they took. A literal RFC1918 address appearing today means that default has been switched off, which matters on two counts — it exposes your internal network layout to every site you load, and it is an unusual configuration in its own right. Severity is warn rather than critical because nothing here contradicts anything: it is a departure from a default, not two sources disagreeing, and legitimate enterprise policy disables it often enough that a stronger claim would be unfair.
How to resolve it
Leave mDNS ICE candidate obfuscation enabled. It is on by default in current Chrome and is normally switched off only by an explicit launch flag or by an enterprise policy predating the feature. If a managed environment disables it, that decision publishes every visitor's internal address to every site they visit.
Nearby checks in Network & WebRTC
- the address WebRTC exits from matches the address this page was served to
webrtc-ip-vs-connectionThis is the one check on this page that cannot be answered from inside the page, and the only one that makes a network call. - relay-forced WebRTC exits the same address this page arrived from
webrtc-turn-egressEvery other WebRTC check on this page reads what the browser is willing to show it. - ICE gathering offers at least one candidate on a working network
webrtc-gathering-suppressedThe other WebRTC rows on this page read what the candidates SAY. - The WebRTC host candidate does not expose a routable public address
webrtc-address-classReading from the same fully offline RTCPeerConnection — built with no iceServers, so host-only gathering, no STUN, no packets — the first… - every server-reflexive candidate has a host candidate behind it
webrtc-srflx-without-hostA server-reflexive candidate is not an address the browser knows about itself. - WebRTC header extensions match the claimed engine family
webrtc-extmap-engine-familyThis check generates an SDP offer and collects its a=extmap RTP header-extension URIs. - The WebRTC SDP offer matches the engine the User-Agent claims
sdp-engine-signatureAn RTCPeerConnection is constructed with no iceServers key, which makes the probe entirely offline: the native stack builds a local SDP… - NetworkInformation is only present on Chromium engines
connection-api-vs-engineThis check compares an API's mere existence against the engine family named by the User-Agent.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Network & WebRTC checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Network & WebRTC — the family webrtc-mdns-host belongs to.