A team spins up fifty antidetect profiles, assigns each one a clean residential IP, and runs them through a basic fingerprint checker. Every profile comes back green: unique canvas hash, plausible WebGL vendor, no headless flags. Two weeks later, half the accounts are in review and nobody can explain why.
Then somebody opens CreepJS, and the picture changes. The trust score sits in the thirties. The lie detector flags six tampered prototypes. The worker scope reports a different timezone than the main window. And the IP geolocation says Frankfurt while the system clock says America/Chicago.
CreepJS is not a detection system that platforms deploy directly. It is a research tool, an open demonstration of how far fingerprint auditing can go when somebody actually tries. That is exactly why it matters to anyone running multi-account or large-scale automation infrastructure: it shows you the class of signals that commercial anti-bot vendors have been quietly productising for years. If your setup cannot survive a CreepJS audit, it is relying on the target site being lazy.
This article covers what advanced fingerprint scanners actually measure, why the proxy exit node sits at the centre of several of those checks, and how to align network identity with browser identity so the two stories match.
What CreepJS Actually Measures
Most fingerprint test pages answer one question: how unique are you? CreepJS answers a harder one: how honest are you? Those are different problems, and conflating them is the root cause of most failed antidetect setups.
A profile can be perfectly unique and still be obviously synthetic. In fact, uniqueness without coherence is a liability, because the artefacts that make you unique are often the same artefacts that reveal tampering.
The lie detector
CreepJS inspects native browser functions to see whether they have been overwritten. When an antidetect browser spoofs navigator.hardwareConcurrency or patches CanvasRenderingContext2D.prototype.getImageData, the patched function often leaves evidence: a changed toString() output, a modified prototype chain, a getter where a value property should be, an unexpected stack trace when the function throws.
The scanner calls these lies, and it counts them. Zero lies is normal for a stock browser. A dozen lies is a profile that has been rewritten at the JavaScript layer rather than at the engine layer. Good antidetect browsers patch lower down the stack precisely to avoid this, which is one of the few meaningful quality differences between tools in that market.
Cross-context consistency
This is where naive setups collapse. A browser exposes overlapping information through several independent contexts: the main window, a dedicated worker, a shared worker, a service worker, and an iframe. Each of those contexts has its own copy of certain APIs.
If a spoofing layer patches only the window scope, the worker scope still reports the truth. CreepJS compares them side by side. A profile claiming Windows 11 in the main thread while a worker reports a Linux platform string is not a borderline case: it is a definitive automation signal, and no amount of IP quality compensates for it.
Timezone is the classic example. Intl.DateTimeFormat().resolvedOptions().timeZone is readable from a worker. So is the UTC offset derived from Date. If your spoofed locale lives only in the window, the mismatch is trivially detectable.
Entropy, stability, and the trust score
CreepJS builds multiple fingerprint hashes and tracks how stable they are across reloads. A real browser is boringly stable: the same canvas hash, the same audio fingerprint, the same font list, session after session. Many spoofing tools inject per-session noise into canvas and audio output to defeat naive hashing. That defeats naive hashing, and it creates a new signal: a device whose hardware fingerprint changes every page load does not exist in nature.
The trust score aggregates lie count, cross-context consistency, API coherence, and the plausibility of the reported hardware and software combination. Commercial vendors compute something conceptually similar and then combine it with behavioural and network signals. Treat the score as a diagnostic, not as a target to game.
Headless and automation residue
Automation frameworks leave traces far beyond navigator.webdriver. CDP (Chrome DevTools Protocol) attachment can be inferred from timing side channels and error-object behaviour. Missing or stubbed permission prompts, unusual window.chrome structure, absent plugin arrays, font sets that match a bare container image rather than a consumer desktop: all of these show up.
Fonts deserve special mention because they bridge the browser and network layers. A profile claiming to be a German consumer desktop should have a font set consistent with a retail Windows installation in that region. A Docker image with three fonts installed is not that.
Where the Proxy Exit Node Enters the Picture
Here is the part that gets skipped. Fingerprint scanners do not only read JavaScript APIs. They read the network, and they cross-reference the two. The exit node you route through is a first-class fingerprint attribute.
IP geolocation versus declared locale. The most-checked correlation in the industry. Your exit IP resolves to a city, a region, and a country. Your browser declares a timezone, a language list, and a set of Intl formatting defaults. When those disagree, you are claiming to be a user in Madrid who has configured their machine for Pacific Time and en-US only. That happens occasionally with real travellers and expats, which is why it is a weighted signal rather than an instant block, but at scale across dozens of profiles it becomes a cluster signature.
ASN classification. Every IP belongs to an autonomous system with a known type: residential ISP, mobile carrier, hosting provider, corporate network, educational institution. A fingerprint claiming an iPhone running Safari over a cellular connection, exiting from a cloud provider ASN, is incoherent before a single JavaScript check runs. Mobile fingerprints need carrier-grade network provenance. Desktop consumer fingerprints need consumer ISP provenance.
WebRTC and DNS exposure. WebRTC ICE candidate gathering can expose local network addresses and, in misconfigured setups, the true public IP behind the proxy. DNS resolution that bypasses the proxy tunnel reveals a resolver in a different country than the exit node. Scanners and detection vendors both look for this. It is the single most common reason a technically sound profile leaks.
Round-trip timing. Latency between the client and the server is measurable. A connection that reports a Brazilian exit IP but delivers 25 millisecond round-trip times to a server in Amsterdam is physically implausible. Chained proxies, overloaded gateways, and badly routed exit nodes all produce timing profiles that do not match their claimed geography. This is subtle and rarely decisive on its own, but it feeds risk models.
TCP and TLS stack characteristics. The handshake your connection produces carries its own fingerprint: initial window size, TTL, TCP options ordering, cipher suite ordering, extension ordering, ALPN values. A proxy that terminates and re-originates connections can overwrite the client's TLS characteristics with its own, producing a mismatch between the browser the JavaScript claims to be and the TLS client the server actually observed.
IP reputation and history. Independent of geolocation, every exit IP carries accumulated reputation: prior abuse reports, blocklist presence, how many other sessions have recently used it, whether it has been seen on the target platform before. A clean fingerprint on a burned IP fails. A mediocre fingerprint on a well-rested residential IP often passes. Reputation is the quiet variable that explains most otherwise inexplicable results.
Building an Aligned Profile: A Practical Workflow
Alignment is a process, not a setting. The sequence matters because each step constrains the next.
Start from the network, not the browser. Choose the exit node first. Its country, region, ASN type, and connection class define the persona you are allowed to claim. Trying to force a predetermined fingerprint onto whatever IP happens to be available is backwards and produces the mismatches described above.
Derive locale from the IP, not from habit. Once the exit is fixed, set timezone, primary language, secondary language list, and number and date formatting to match that region realistically. A Polish residential exit should usually present pl-PL with en-US secondary, Europe/Warsaw timezone, and matching Intl output. Set these at the profile level so they propagate to worker contexts, not through a content script that only touches the window.
Match hardware claims to the market. Device claims should reflect what people in that region actually buy. Screen resolution, device pixel ratio, CPU core count, and reported memory should sit in common ranges. A 32-core workstation with a 1366x768 display is not a device anyone owns.
Verify the full exit path. Before a profile touches the target, confirm what the outside world sees: public IP, ASN, geolocation, DNS resolver country, WebRTC candidates, and whether any IPv6 path is bypassing the tunnel. Running each new exit through a proxy testing tool takes seconds and catches the leaks that would otherwise show up as an unexplained ban three days later.
Audit, then correct, then re-audit. Load CreepJS (or an equivalent audit page) inside the actual profile, with the actual proxy attached, in the actual browser build you will use in production. Record the lie count, the worker-versus-window deltas, and the fingerprint stability across three reloads. Fix the highest-severity mismatch, then re-run. Do not chase the trust score number itself: chase the specific contradictions.
Lock the pairing. Once a profile and an exit are aligned, keep them together. Session persistence is part of the fingerprint. A device that teleports between ISPs every few minutes is not a device.
Common Mistakes That Undo Good Work
Treating uniqueness as the goal. Randomising canvas, audio, and WebGL output on every load produces an unstable fingerprint, which is itself anomalous. Stable and plausible beats unique and noisy.
Spoofing only the window scope. Already covered, but worth repeating because it remains the most common failure in home-rolled setups built on plain Playwright or Puppeteer with injected scripts.
Rotating the IP mid-session. A session that changes exit IP halfway through a logged-in flow triggers session-integrity checks on most mature platforms, independently of fingerprinting. Rotation belongs between sessions, not inside them.
Ignoring IPv6. If the host has IPv6 connectivity and the proxy is IPv4 only, some requests may leave over the native IPv6 path. The result is two different public addresses in one session.
Using one pool type for everything. Datacenter exits are fine for public, unauthenticated data collection where the target does not weight ASN heavily. They are a poor match for a profile claiming to be a consumer on a home connection. Mobile exits carry excellent trust on social platforms and poor economics for bulk crawling. Pool choice is a per-workload decision.
Testing in the wrong environment. Auditing a fingerprint on your own machine without the proxy attached tells you almost nothing. The whole point is the interaction between the browser profile and the network path.
Where Proxies Fit In
Everything above converges on one requirement: the exit node has to be able to support the story the browser is telling. That is a sourcing problem before it is a configuration problem.
If a provider's residential pool is thin in a given country, you end up reusing the same handful of IPs across many profiles, and the correlation between those profiles becomes visible at the platform level regardless of how clean each individual fingerprint looks. If the pool is a mix of genuine consumer lines and repackaged hosting space, your ASN classification is unpredictable, and the desktop-consumer persona you built will occasionally exit from an address that classifies as a data centre.
This is where pool diversity, honest ASN labelling, and genuine geographic depth stop being marketing language and start being operational requirements. Being able to choose between residential, ISP, datacenter, and mobile exit pools within one account matters because different workloads need different network personas, and switching providers every time a persona changes is not a workable process.
EnigmaProxy sits in the professional tier of that market, with ethically sourced residential and mobile pools, ISP and datacenter options for workloads where consumer provenance is not required, and sticky session controls that let a profile hold the same exit for the duration of a session rather than rotating mid-flow. For fingerprint alignment work, three things carry disproportionate weight: country and city-level targeting granularity so locale settings can be derived accurately, session duration control so the pairing between profile and IP stays stable, and clear separation between pool types so an ASN-sensitive workload never silently exits through the wrong class of address.
The broader point is that proxy infrastructure and fingerprint engineering are not separate disciplines. A team that invests heavily in one while treating the other as a commodity line item will keep getting results it cannot explain.
Future Trends and Strategic Insights
Detection is moving from snapshots to histories. The current generation of anti-bot systems is less interested in whether a single page load looks clean and more interested in whether a device identity behaves consistently over weeks. That rewards long-lived, stable profile-to-IP pairings and punishes disposable identities. Plan for persistent allocations rather than maximum rotation.
Browser vendors are reducing passive entropy. Privacy work in Chrome and Safari keeps shrinking the amount of information available passively: fewer plugin details, reduced user-agent granularity, more partitioned storage. The paradoxical effect is that remaining signals carry more weight, and network-layer signals (ASN, geolocation coherence, TLS characteristics, timing) rise in relative importance. The proxy layer is becoming more decisive, not less.
Cross-context auditing will become standard, not research. The worker-scope comparisons that CreepJS popularised are cheap to run and hard to fake. Expect them in mainstream commercial detection, which raises the bar for antidetect tooling and makes engine-level spoofing the only durable approach.
Machine-learned coherence scoring replaces rule lists. Rather than a fixed list of forbidden combinations, detection models increasingly learn the joint distribution of fingerprint and network attributes from real traffic and flag the improbable. You cannot pass that by memorising rules. You pass it by being genuinely plausible: real consumer network provenance, regionally coherent settings, stable hardware claims, human-paced behaviour.
Residential sourcing scrutiny tightens. Regulatory and platform pressure on how residential IP pools are built continues to increase. Buyers who have documented consent chains and clear sourcing disclosure from their provider will have fewer disruptions than those relying on opaque supply.
Conclusion
CreepJS is valuable precisely because it is uncompromising. It will show you the contradictions in your setup that a target platform notices quietly and acts on later. The lesson it teaches is not that you need a higher score, but that coherence beats concealment: a profile that tells one consistent story across the window, the workers, the TLS handshake, and the exit IP survives far longer than one that hides aggressively in some layers and leaks in others.
Practically, that means building from the network outward. Pick the exit node, derive the locale and hardware persona from it, verify the full exit path for leaks, audit inside the real environment, and keep the pairing stable. Treat rotation as something that happens between sessions, and treat pool type as a deliberate choice tied to the persona you are presenting.
The infrastructure underneath has to cooperate with that discipline. Providers such as EnigmaProxy that offer diverse, ethically sourced pools with real geographic depth and reliable session control give fingerprint engineering something solid to stand on, which is ultimately the difference between a setup that passes an audit once and one that keeps working in production.