May 14, 2026
Caught wearing the same mask again?
Mullvad exit IPs are surprisingly identifying
Your ‘private’ VPN may be giving you the same digital fingerprint every time — and commenters are already at war
TLDR: A researcher says Mullvad may be giving users repeatable address patterns instead of truly mixing them up, making people easier to tell apart than expected. Commenters are split between outrage, shrugging acceptance, and the classic internet take that VPNs were overrated all along.
A fresh deep dive into Mullvad has the privacy crowd doing the online equivalent of dropping their coffee. The big reveal? This popular virtual private network — a tool people use to hide where they’re browsing from — may be handing users a repeatable, recognizable public-facing address pattern instead of mixing things up every time. The researcher tested thousands of key changes across nine servers and found something that felt less like chaos and more like a suspiciously neat seating chart: only 284 address combos showed up, despite trillions of possible combinations. In plain English, your “random” mask may not be so random after all.
And the comments? Absolute fireworks. One camp immediately demanded answers, with gruez basically yelling, why make it more complicated unless there’s a reason? Another faction went full scorched earth: “VPNs are snake oil” became the thread’s bluntest mic-drop, courtesy of wg0. Then came the chaos gremlins, including one commenter gleefully pointing out that site owners might actually love this because it could make banning bad actors easier. That, naturally, turned a privacy discussion into a morality play about whether VPNs protect users or protect trolls.
The funniest part is how quickly the thread split into three genres at once: panic, cynicism, and confused troubleshooting. Some shrugged and said it’s fine if it’s only a fake name, not your real identity. Others zoomed in on a practical mystery: if Mullvad’s own app can rotate keys, why can’t third-party apps do it too? The result is peak internet drama: half detective story, half trust crisis, and half people arguing that the whole product category is nonsense.
Key Points
- •The article says Mullvad assigns exit IPs deterministically based on a user’s WireGuard key rather than randomizing them on each connection.
- •The author tested nine Mullvad servers and collected exit IP data for 3,650 public keys over one night.
- •Although the theoretical combination space across those servers exceeded 8.2 trillion possibilities, the test observed only 284 distinct exit IP combinations.
- •The article reports that assigned IPs across servers tend to fall at similar percentiles within each server’s IP pool.
- •Based on repeated index matching between servers with equal pool sizes, the article hypothesizes that Mullvad uses a seed-based RNG with pool size as the bound to choose exit IP indexes.