The ritual is familiar to anyone who manages more than one account: you launch your profile in an anti-detect browser, connect a proxy, open Pixelscan, see green — and start working. Two days later, you get banned. The checker said everything was clean.
The problem is that "clean" means different things to different checkers. Pixelscan, Iphey, CreepJS, and BrowserScan measure different aspects, argue with each other on the same profile, and — most importantly — none of them checks the actual reasons for your ban. Below is an analysis of what each tool looks for, whom to trust in which scenario, and where the checker's responsibility ends.
What the checker measures and what the site measures are different lists
Modern anti-bot protection consists of five layers, all working simultaneously: IP reputation and request speed, TLS handshake fingerprint, browser fingerprint (hundreds of environmental signals), behavioral analysis, and active challenges like CAPTCHAs. The behavioral layer observes erratic mouse movements, variable scrolling speeds, random misses on buttons, and natural pauses between actions — while bots exhibit linear trajectories and perfectly timed actions. DataDome, for example, collects cursor coordinates, scrolling acceleration, intervals between clicks, and sequences of key presses.
The key takeaway from the analysis of anti-bot systems: "a different IP with the same browser fingerprint is detected just like the same IP with different user-agents." Signals correlate together, not one by one.
Now compare this with the list of what an online checker can do. It opens in your tab, takes a snapshot of the environmental state once, and shows discrepancies. It doesn't see how you move the mouse for the next forty minutes, doesn't know the history of that IP on a specific site, and doesn't have access to Cloudflare's or DataDome's internal ML model. The checker is a mirror, not a pass.
CreepJS — the most malicious, because it looks for lies
CreepJS is an open project by Abraham Juliot on GitHub (MIT license, about 2,500 stars and 287 forks). The stated goal is right in the repository description: to highlight weaknesses and privacy leaks in modern anti-detect extensions and browsers. It analyzes 21+ vectors: canvas, WebGL and GPU parameters, audio, fonts, speech synthesis voices, screen properties, time zone, CSS styles, DOM characteristics, and JS engine signatures.
The fundamental difference between CreepJS and a regular fingerprint collector is its lie detection. It doesn't ask "what GPU do you have," it checks whether the GPU response in the main thread matches the response in the worker thread, whether native functions have been overridden, whether the canvas hash is stable between measurements, and whether the user-agent matches what the engine shows. Reviews provide benchmarks for trust scores: a regular browser — 95% and above, Tor Browser — around 50%. A separate detail that many overlook: CreepJS scans localhost to find the local API server of the anti-detect application.
Important warning from the repository itself: only the official deployment at abrahamjuliot.github.io/creepjs is considered safe. Other domains with this name are marked by the author as malicious mirrors, and the name CreepJS is registered as a trademark. Googling "creepjs" and clicking the first link is a bad idea.
Pixelscan — about hardware consistency and channel status
Pixelscan checks a combination of six directions: fingerprint analysis (canvas, WebGL, audio, fonts, HTTP headers), IP determination with provider, geolocation, and blacklist status, signs of proxy or VPN masking, DNS leaks, signs of automation (WebDriver, headless, Selenium), and address reputation.
The strong point is checking internal consistency: whether the canvas and WebGL values match between your profiles (if they match — the profiles are linked), whether the declared OS matches the real renderer parameters, and whether the real provider is exposed through DNS.
A clearly stated limitation to remember: Pixelscan does not protect anything; it only shows the information you are leaking. Plus, it doesn't know all emerging fingerprinting methods, and results vary depending on the device, OS version, and browser.
Iphey — "does it look like a real person"
Iphey breaks down the result into sections: browser, geolocation, IP address, hardware, software, plus separate checks for fingerprint, proxy/VPN, bot, DNS leaks, and blacklists. Its verdict wording is not technical but general — in the spirit of "your digital identity looks trustworthy" when all categories are green.
The practical value of Iphey is that it catches discrepancies between the time zone and the geolocation of the IP and low-quality proxies. It can also name the anti-detect environment — in July 2026 testing on the AdsPower profile, the signal panel directly stated "Detected anti-detect browser environment (ads)."
BrowserScan and BrowserLeaks — neighbors with different reputations
BrowserScan almost duplicates Iphey in its checks: IP and geolocation, user-agent, WebGL and canvas, WebRTC, DNS leaks, audio fingerprint, hardware characteristics, driver versions, time zone, bot detection. Its main complaint is a high percentage of false positives: in testing, it marked genuine profiles as fake, whereas Iphey correctly processed all ten. A disclaimer: this test is published on Iphey's own blog, meaning the comparison was made by an interested party, and it should be treated as a hypothesis for your own verification, not as independent arbitration.
BrowserLeaks stands apart: it is not a "trust score" but a detailed audit of each API separately — canvas 2D, WebGL, WebRTC with STUN requests, audio. It won't say "you are a bot" or "you are a human"; it will show the raw values your browser returns. For debugging a specific parameter, this is more convenient than any traffic light. Separately in the niche lives bot.incolumitas.com, focused specifically on automation artifacts: traces of CDP, navigator.webdriver, timing anomalies.
What each finds in practice
The July 2026 testing of anti-detect browsers shows exactly what profiles are caught on — and it is not "bad canvas," but everyday inconsistencies:
- Incogniton — a floating number of CPU cores (8 in one measurement, 16 in another) and an incorrect macOS 12_2_1 token in the user-agent, while real Chrome on macOS always returns the frozen 10_15_7.
- Nstbrowser — a physically impossible configuration: 16 cores on an eight-core M3.
- Dolphin Anty — application process detected by scanning local port 3001.
- AdsPower — environment identified by name in Iphey's signals.
Note the nature of the findings: none of them are about the quality of canvas spoofing. These are logical contradictions — the declared hardware does not match the real one, the OS version is pulled from thin air, and the local API server responds to requests from the page. This is exactly what both the anti-bot system looks for, and that is why a detailed map of signals from a specific site is useful to manually extract from its detection scripts, rather than relying on a universal traffic light.
How to use this set: order for the task
- Created a new profile. First, run CreepJS — it will find gross contradictions and overridden functions before the site does. Look not at the final percentage, but at the list of discrepancies.
- Changed proxy or geo. Iphey and Pixelscan: time zone, system language, geolocation of IP, and DNS should match in one country. This is the most common and easiest to fix error.
- Debugging one parameter. BrowserLeaks — it will show the raw value without interpretation.
- Running automation. bot.incolumitas.com for traces of CDP and webdriver.
- Managing multiple profiles. Compare canvas and WebGL hashes between them. Identical values mean that the profiles are linked into one identity, even if each is "green" individually.
And a mandatory rule: discrepancies between checkers are not a reason to look for the "right" checker, but a signal that the parameter is indeed borderline. If Pixelscan is satisfied, but CreepJS complains about WebGL mismatch between streams, CreepJS is right: real anti-bot scripts check exactly this combination.
What none of them will show
Everything that accumulates over time and outside your tab:
- The history of the IP on a specific site. The address may be impeccable according to blacklists and still have been flagged in three bans on the site you need. A separate large topic is that IP reputation assessments poorly describe residential addresses: complaints reflect postal policy, not your activity.
- Behavior. No checker evaluates how you type, scroll, and navigate between pages.
- Account age and history. An ideal fingerprint on a freshly registered profile with zero activity is suspicious in itself.
- Internal site rules. The blocking threshold for a marketplace, social network, and bank varies, and it is not published.
Where proxies fit in
Fingerprint checkers and channel quality are two different layers, and you cannot substitute one for the other. An anti-detect browser changes how you appear as a device; a proxy determines where you come from and what this address resembles. A green CreepJS on a datacenter address from a subnet that the site knows as server-based won't help: the network layer will work before canvas and fonts come into play.
The practical conclusion is simple. For multi-accounting and working with sites where it is important to appear as a regular home user, use residential proxies — addresses from real providers with normal geography. For the most sensitive scenarios — social networks, messengers, platforms with strict anti-fraud measures — use mobile proxies: behind one operator's address sit hundreds of real subscribers, and blocking it entirely is costly for the site. And watch for the basics: the profile's time zone, language, and IP geolocation must match. This is the parameter that all four checkers catch at once — and which is most often broken manually.
In short
CreepJS looks for logical contradictions and overridden functions — the strictest and most useful at the profile building stage. Pixelscan checks hardware consistency and channel status. Iphey provides a generalized verdict and effectively catches discrepancies between geo and time zone. BrowserScan covers the same perimeter, but has complaints about false positives. BrowserLeaks provides raw values for debugging. All green checks together mean only one thing: you haven't failed the inconsistency check. Beyond this begins what the checker does not measure — behavior, address history, and account reputation. Plan your work as if the traffic light does not exist, and it only protects against silly mistakes. Then it truly serves as a safeguard.