You bought a good residential proxy, set up a profile in an anti-detect browser, but your Facebook Ads or Instagram account still gets banned within a couple of days. The reason is often not the IP address itself, but the fact that the system's time zone, browser language, or WebRTC data contradict the proxy's geolocation. Platforms have long learned to cross-check these parameters against each other, and any discrepancy is a direct signal to the anti-fraud system. Let's break down all 5 key leakage points and show how to close them.
Why discrepancies expose proxies
Facebook, TikTok, Google, and marketplaces like Wildberries and Ozon no longer limit themselves to checking a single IP address. Anti-fraud systems collect dozens of browser parameters — the so-called fingerprint — and cross-check them for consistency. If the IP points to Warsaw, but the system's time zone is set to Moscow, the system sees a clear mismatch and assigns a higher risk score to the profile. The account is either blocked immediately, ad displays are limited, or phone verification is required — in any case, this is a blow to the business of the arbitrageur or SMM agency.
The problem is that the proxy itself is not to blame — it merely changes the visible IP. All other parameters (time zone, language, OS locale, WebRTC) remain from your real system unless configured separately. That’s why the combination of “proxy + anti-detect browser” is important, rather than just purchasing an IP.
Discrepancy #1: System time zone and IP
The most common and critical leak. The browser can easily inform the site of the computer's real time zone through JavaScript (Intl.DateTimeFormat().resolvedOptions().timeZone). If you are working through residential proxies with IPs from Germany, but the system clock is set to Yekaterinburg, the difference in time zones is instantly detected by Facebook Pixel or TikTok Ads scripts and recorded as an anomaly.
This is especially dangerous for arbitrageurs who manage 10-20 ad accounts from different geos simultaneously. If all profiles are physically launched from one machine without changing the time zone, the platform sees the same time zone for accounts that are supposedly located in different countries — this is a direct path to a chain ban, where the entire chain of linked accounts is blocked at once.
The solution is simple: the time zone of the browser profile must automatically adjust to the geo of the IP address. This can be done either manually in the virtual machine settings or — more conveniently — through an anti-detect browser that synchronizes the time zone with the proxy each time the profile is launched.
Discrepancy #2: Browser language (Accept-Language)
Every HTTP request from the browser contains the Accept-Language header, which tells the server the preferred interface language. If the IP points to Brazil, but the header says “ru-RU, ru,” this is another clear signal of inconsistency. For SMM specialists managing Instagram accounts for clients in different countries, this is especially critical: the feed and recommendation algorithms partially rely on the browser language, and an account with the “wrong” language warms up worse and is more likely to fall under a shadow ban.
An important nuance: the browser language and the operating system interface language are different parameters, and sites check both. It is not enough to change the language in Chrome settings if Windows or MacOS itself operates on a Russian locale — the discrepancy will still be visible through system APIs.
| Proxy Geo | Correct Accept-Language | Common Mistake |
|---|---|---|
| USA | en-US, en | ru-RU, ru left by default |
| Germany | de-DE, de, en | en-GB without German priority |
| Poland | pl-PL, pl, en | uk-UA, ru left by default |
Discrepancy #3: Operating system locale
In addition to the browser language, websites read the operating system locale through JavaScript APIs — date format, number separator, first day of the week in the calendar. For example, navigator.language and navigator.languages return a list of system languages, and if Russian is at the top with an American IP — that’s another minus in the trust scoring.
For sellers monitoring prices on Wildberries or Ozon through parsers simulating a browser, this is also important: marketplaces ban sessions with an atypical locale for the region, mistaking them for bots. The solution is to use virtual profiles with a completely replaced OS locale, not just the browser interface language.
Discrepancy #4: WebRTC leak
WebRTC — a technology for video calls and peer-to-peer connections in the browser — by default can determine the user's real IP address bypassing the proxy. This happens through STUN servers, which request the local and public IP directly from the network stack, bypassing the proxy settings in the browser. As a result, the site sees two IPs simultaneously: one from the proxy in the HTTP request headers, the other — the real one, through the WebRTC request.
This is one of the most dangerous types of leaks precisely because it is invisible to the user — everything seems to work normally, the site opens, but in the background, the browser "leaks" the real address. Facebook and TikTok Ads actively use this check to detect multi-accounting: if 10 different ad accounts show the same home IP through WebRTC — that’s a guaranteed chain ban.
This can be closed either by completely disabling WebRTC in the browser settings or by replacing the WebRTC IP with the same address that the proxy provides. The second option is preferable, as completely disabling WebRTC itself may be a suspicious sign for some anti-fraud systems, which expect to see at least some WebRTC response from a regular user.
Discrepancy #5: Browser Geolocation API
The browser Geolocation API determines the physical location of the device through GPS, nearby Wi-Fi networks, and cellular tower data — this is much more accurate than just determining by IP. If a site requests geolocation and the user allows it, the browser can provide coordinates that do not match the geo of the proxy IP at all, even down to a different country.
For arbitrageurs, this is especially critical when working with Google Ads and TikTok Ads, which often request geolocation for local targeting. The solution is to set up fake coordinates in the anti-detect browser's Geolocation API that correspond to the proxy geo, or to completely block geolocation requests, simulating a user refusal (this looks natural, as many real users also deny access).
How anti-detect browsers fix this
Manually tracking all 5 parameters for each profile is time-consuming and prone to errors, especially if you manage 20-50 accounts. That’s why arbitrageurs and SMM specialists use anti-detect browsers: Dolphin Anty, AdsPower, Multilogin, GoLogin, Incogniton, Octo Browser. All of them can automatically pull the time zone, language, and geolocation based on the proxy geo when creating a profile.
A typical setup algorithm in Dolphin Anty looks like this: create a new profile → in the “Proxy” section, enter the data (IP, port, username, password, SOCKS5 or HTTP type) → click the proxy check button → the browser automatically determines the country, time zone, and language based on the IP and offers to apply them to the profile → confirm. In AdsPower, the process is similar: when adding a proxy, there is an option “Synchronize timezone with IP,” which only needs to be enabled once for all new profiles.
For this automatic synchronization, it is important that the proxy itself is stable and provides correct geodata in response to requests. For Facebook Ads and TikTok Ads accounts, the best fit is residential proxies — they have real IPs of home users, which return accurate and plausible country and city during geolocation checks, reducing the risk of discrepancies across several points from the list above.
Checklist before launching an account
Before launching a new account or advertising campaign, it is worth going through a short checklist — it takes 2-3 minutes but saves hours on recovering banned profiles.
- The profile's time zone matches the country of the proxy IP address
- The browser's Accept-Language corresponds to the language of the target country (not left by default)
- The operating system locale in the profile is replaced, not inherited from the host machine
- WebRTC is either disabled or replaces the IP with the proxy address
- The Geolocation API returns coordinates within the proxy geo or correctly blocks the request
- The profile's fingerprint has been checked through an external service before the first login to the account
Services for checking fingerprint
Before logging into a working account, it is useful to run the profile through fingerprint checking services. This allows you to see exactly what the site sees when accessing from your profile — all inconsistencies will be highlighted immediately.
| Service | What it shows |
|---|---|
| browserleaks.com | WebRTC leaks, language, time zone, Canvas fingerprint |
| pixelscan.net | Overall profile consistency scoring, fingerprint suspicion |
| whoer.net | Compliance of IP, DNS, time zone, and browser language |
| iphey.com | Detailed report on profile trustworthiness with a list of inconsistencies |
If at least one of these services marks your profile as “suspicious” or “atypical,” it is worth rebuilding the profile from scratch before accessing the social media account or ad cabinet.
Conclusion and recommendations
A proxy only solves part of the problem — replacing the visible IP address. The time zone, browser language, OS locale, WebRTC, and Geolocation API are five more points that platforms use to verify the plausibility of your profile. A discrepancy in at least one of these parameters increases the account's risk scoring and brings it closer to a ban, and in the case of multi-accounting, it can lead to the loss of an entire chain of profiles.
Closing all five leaks manually is possible, but time-consuming, especially when managing dozens of accounts. Therefore, it is wiser to set up a combination of an anti-detect browser with automatic parameter synchronization and a quality proxy. For stable farming of Facebook Ads and TikTok Ads, mobile proxies work best — they are less likely to be blocked due to the dynamic IP changes of real telecom operators. For mass parsing of marketplaces like Wildberries and Ozon, where speed is more important than maximum anonymity, data center proxies are more suitable — they are faster and cheaper while maintaining comparable connection stability.
In any case, before launching each new profile, it is worth going through the checklist from this article and running it through one of the fingerprint checking services — this is an inexpensive insurance against losing accounts that took weeks of work to warm up.