Pixelscan is a free browser and IP check that runs your current browser plus proxy and returns tiles for Browser, Location, Proxy, Fingerprint and Bot check. Most "bad" results come from three fixable mismatches: your timezone or language not following the proxy's location, WebRTC exposing your real IP, and an IP that resolves to a datacenter instead of a carrier. Fix those before worrying about "Masking detected": a mismatch is a contradiction any site can read, while masking alone is common among privacy-minded users.
What each tile actually compares
The fingerprint check pulls two sets of signals and looks for disagreement between them:
- IP-side: geolocation from the IP, User Type by IP (the network class the address belongs to), time from IP.
- Browser-side: timezone reported by JavaScript, languages reported by JavaScript versus the
Accept-Languageheader, WebRTC IP address, plus WebGL, Canvas, AudioContext and font hashes.
A verdict like "Your Browser Fingerprint is inconsistent" means those two sets disagree somewhere, not that your fingerprint hashes are rare. Pixelscan also ships separate tools for IP blacklist, VPN check, DNS leak and WebRTC leak, so a clean fingerprint page does not mean your IP reputation is clean.
Rank fixes by what contradicts itself
Pixelscan is ordinary JavaScript on a web page, so any site's anti-bot script can run similar tests, including the one behind "Masking detected". The difference is weight. A US exit with a Warsaw clock is a contradiction; replaced canvas or WebGL values are also what Brave's fingerprint randomization produces for millions of normal users. Fix the contradictions first (IP type and ASN, timezone and language agreement, WebRTC, DNS) and stop chasing a screen with zero flags.
Fix in this order
1. WebRTC leaking your real IP
The WebRTC line shows the IP address your browser hands out over WebRTC. If it prints your home or server address while the HTTP request comes from the proxy, every site that asks for a WebRTC candidate sees both. This is the single worst finding on the page because it is a direct identifier, not a heuristic.
In an antidetect profile, set WebRTC to the mode that replaces the WebRTC address with the proxy IP (usually labelled "Replace"/"Altered" or "based on proxy"), not "Disabled" and not "Real". Disabling WebRTC entirely is itself unusual on a mobile-shaped profile. Re-run the check and confirm the WebRTC address matches the exit IP, or use the standalone WebRTC leak test.
2. Timezone or language disagrees with the IP
Pixelscan compares Timezone from JS against Time from IP. A profile left on your machine's system timezone with a proxy in another country is the most common cause of an inconsistent verdict. Set the profile's timezone to "Based on IP" (auto) so it follows whatever exit you connect through, and set geolocation the same way so the permission prompt returns coordinates in the proxy's region rather than your own.
If you run one profile across several exits, this must be automatic. A hardcoded timezone only makes sense when the profile is pinned to one country on a sticky session.
The language check reads the language list from JavaScript and compares it to the Accept-Language header. Two failure shapes: the header and the JS list differ (proxy or extension rewriting one of them), or both agree but neither matches the proxy country. Set the profile language to follow the IP, then decide deliberately: a US exit with en-US is unremarkable; a German exit reporting only ru-RU is a signal you chose to send. Keep the JS list and the header identical, in the same order, and confirm the pairing with the location consistency test.
3. The Proxy and User Type lines
Two separate readings. The Proxy tile can report "No proxy detected", which is what a carrier mobile IP behind CGNAT typically produces: the address belongs to a mobile operator's ASN and looks like a phone, because it is a phone. The User Type line is Pixelscan's reading of what kind of network the address belongs to, and for account traffic that is supposed to come from a handset you want it to read as a mobile carrier, not hosting.
A datacenter User Type on something sold as a mobile proxy means the address is resolving to a hosting ASN or to a stale database record. That is a different problem with its own fixes, covered in mobile proxy shows as datacenter. Verify the ASN and type independently with the IP Type Checker before you change anything in the browser profile, because no fingerprint setting will fix a hosting IP.
Check your exit IP type, carrier and ASN
4. Fingerprint hashes and Bot check
WebGL, Canvas, AudioContext and font hashes are shown so you can see what your profile emits. Aim for plausible, not unique: hashes that match a real device class (an Android build with matching GPU strings, fonts and screen metrics) beat noisy per-session randomization, which produces a device that never existed twice. The Bot check line reporting "No automated behavior detected" reflects input patterns during the scan, so it will read differently for a headless run than for a hand-driven one; treat it as a reminder that pacing and interaction are separate from fingerprinting.
For choosing a profile engine and how far its hash handling goes, the longer comparison is in best antidetect browser for device fingerprinting.
The Proxy Checker is a different tool
Pixelscan's Proxy Checker is a desktop app with a Chrome and Firefox extension. It takes a single IP:PORT or a .txt list and returns a 0-100 speed, stability and reliability score plus a fraud score and location, with 100 free checks available. Use it to triage a list of endpoints before you assign them to profiles. It does not test your browser profile, so a high score there says nothing about timezone, language or WebRTC agreement.
| Check | What it tells you | What it cannot tell you |
|---|---|---|
| Fingerprint check (browser) | Whether browser-side and IP-side signals agree | Whether the IP is blacklisted or DNS leaks |
| Proxy Checker (app) | Speed, stability, fraud score and location of an endpoint | Anything about your profile configuration |
| IP blacklist / VPN / DNS leak tools | Reputation and resolver exposure of the exit | Whether your timezone matches the exit |
When the result stays bad after the fixes
Two causes remain once timezone, language and WebRTC follow the proxy:
- The exit changed mid-scan. A per-request rotating pool can hand the page one IP for the initial load and another for a later request, which reads as a location mismatch. Run the check on a sticky session so one IP serves the whole scan.
- The IP class is wrong for the job. No profile setting converts a hosting address into a carrier one. If the account you run expects handset traffic, the exit has to be a real device on a mobile network.
1Is Pixelscan free?
Yes. The browser fingerprint check at pixelscan.net runs without registration. The separate Proxy Checker desktop app includes 100 free checks.
2What is Pixelscan used for?
Auditing your own browser plus proxy setup before you use it: it shows your IP data, User Type, WebRTC address, timezone and language agreement, and your WebGL, Canvas, AudioContext and font hashes, and flags disagreement between browser-side and IP-side signals.
3How accurate is Pixelscan?
It is accurate about what it measures, which is consistency between the signals your browser exposes and the data attached to your IP. It is not a prediction of how a specific platform will score you: it weighs every mismatch and every masked value, while each platform chooses which signals it acts on.
4What does 'Masking detected' mean?
Values the browser reports have been replaced rather than coming from the underlying system. It confirms an antidetect profile is altering that value. Websites can run similar tests, but privacy browsers randomize the same values for ordinary users, so masking alone is a weaker signal than a timezone or WebRTC mismatch. Never trade consistency for a cleaner masking line.
5How do I check if I am behind a proxy?
Load the fingerprint check and read the Proxy tile and the IP data. A carrier mobile exit commonly returns 'No proxy detected' because the address belongs to a mobile operator. For the network class and ASN on their own, run our IP Type Checker.
Get an exit that passes on the IP lines
Real 4G/5G devices behind carrier NAT: dedicated devices you rotate on demand, or pay-per-GB pools with sticky sessions.