Some information reaches every server your browser talks to, because the connection or the protocol needs it. Bye Spy shows it first, under Seen by every site, so that the rest of the report can be read against it, and leaves it out of the score: no browser setting removes it, and a score should judge what the browser controls.
Your network address
What Bye Spy shows
The IP address the test's server saw for the page request, and the host name it resolves to in reverse DNS, if any.
Why it matters
An IP address is the one identifier no page can avoid receiving. It locates you approximately, often names your internet provider through its reverse DNS name (which can include a town or a customer line type), and on a home connection it can stay the same for days or months, linking every site you visit in that time.
$ dig -x 198.51.100.23 +short
dsl-198-51-100-23.springfield.example-isp.net.Geolocation from an address is less precise than it looks: a 2011 comparison of commercial databases against an internet provider's own records found them right about the country for 96–98% of address blocks, but routinely hundreds of kilometres off at city level[1].
What changes it
Only a different network path: a VPN, Tor, or a relay such as iCloud Private Relay, which splits the connection between two operators so that neither sees both your address and the site you visit, while keeping an address that maps to your approximate region[2]. Each of these moves trust from your internet provider to the relay operator. None is a browser setting, which is why the address is shown, not scored.
Your browser and languages
What Bye Spy shows
The User-Agent and Accept-Language headers your browser sent with the page request, and whether it sent DNT: 1 (Do Not Track). The report's file names your browser and operating system from them.
GET / HTTP/2
Host: byespy.heysec.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Accept-Language: en-GB,en;q=0.9,et;q=0.8
Sec-CH-UA: "Google Chrome";v="141", "Not?A_Brand";v="8", "Chromium";v="141"
Sec-CH-UA-Platform: "macOS"Why it matters
Every server learns your browser, its major version, your operating system and your language preferences on the first request, before any script runs. These are the first attributes of any fingerprint. Browsers have reduced how much the User-Agent says, Chrome froze the operating-system version and minor browser version in 2022–2023[3], but the remainder is needed for sites to work and is the same for everyone using the same browser version, which is why Bye Spy does not score it. The extra details a Chromium browser hands out on request are scored, under Detailed device hints.
Do Not Track
Do Not Track was a header asking sites not to track you. No law required anyone to honour it, and few did. Safari removed it in 2019 and Firefox removed its setting in version 135 (2025); the specification is discontinued[4]. Sending it now mostly makes a browser rarer. Its successor, Global Privacy Control, has legal force in several jurisdictions and is scored under Other leaks.
References
- I. Poese, S. Uhlig, M. A. Kaafar, B. Donnet, B. Gueye. "IP Geolocation Databases: Unreliable?" ACM SIGCOMM Computer Communication Review 41(2), 2011. inl.info.ucl.ac.be/…/paper.pdf
- Apple. "iCloud Private Relay Overview." December 2021; "About iCloud Private Relay." apple.com/icloud/docs/iCloud_Private_Relay_Overview_Dec2021.pdf, support.apple.com/en-us/102602
- The Chromium Projects. "User-Agent Reduction." chromium.org/updates/ua-reduction
- Mozilla. Firefox 135.0 release notes, February 2025; MDN, "DNT" (deprecated). firefox.com/en-US/firefox/135.0/releasenotes, developer.mozilla.org/…/Headers/DNT