Loading
Initializing detection systems...
Loading
Initializing detection systems...
Definitions
This page translates Pixelscan's labels into plain English so you can move from a verdict to the underlying evidence without guessing what the terms mean.
Reviewed on July 28, 2026
Use it when a scan result is technically correct but operationally unclear. The definitions below focus on how Pixelscan uses each term, where the signal comes from, and what it can and cannot prove.
If you need the broader product story, continue to About Pixelscan. If you want to test a live session, go back to the dashboard.
Read the trust score and verdict as a summary, then inspect the reasons before making any decision.
Open the dashboardSeparate network-origin signals from browser-origin signals before assuming a mismatch means spoofing.
Read the method pageIf a VPN or proxy is involved, leak testing matters as much as the visible public IP.
Run leak checksThese definitions match the language used across Pixelscan's network, browser, leak, and consistency pages.
Autonomous System Number. A label for the network operator that announced the IP address you are using.
ASNs help explain whether traffic comes from a residential ISP, mobile carrier, cloud platform, or other network operator. Pixelscan shows ASN and ISP details in the network views because hosting or datacenter ASNs often behave differently from residential ones.
A collection of browser and device characteristics that, when combined, can make one environment distinguishable from another.
A fingerprint is not one field. It is the combined shape of items such as user agent, screen size, Canvas output, WebGL output, locale, platform hints, fonts, and other browser-exposed properties. Pixelscan breaks these apart so you can see which claims are stable and which ones conflict.
A hash derived from how a browser renders graphics into an HTML canvas.
Different operating systems, GPU drivers, fonts, browsers, and privacy tools can change the rendered output. Canvas hashes are useful because they are easy to compare between sessions, but they are still heuristics and can change after updates or browser hardening.
Structured browser-provided hints such as platform or mobile state that modern browsers can expose alongside or instead of a classic user agent string.
Client Hints can make identity claims easier to parse than a raw user agent. They are still browser claims, not independently verified truth, so Pixelscan compares them with other signals rather than trusting them on their own.
A set of rules that compares browser claims, network hints, and leak results to find contradictions.
Examples include timezone mismatches, platform inconsistencies, or WebRTC results that disagree with the current public IP. Consistency checks matter because a spoofed setup can pass some single-signal tests while still contradicting itself overall.
A situation where DNS resolution behavior reveals a different network path than the one your main traffic appears to use.
A real resolver-observation test must compare the DNS path with the VPN or proxy path. Pixelscan currently performs a limited DNS-over-HTTPS reachability check; it cannot identify the operating system's active resolver or prove by itself that a connection is leak-free.
A risk assessment derived from the current IP address and the network it belongs to.
Reputation signals can include privacy flags such as VPN, proxy, tor, hosting, or provider-specific risk scores. Pixelscan treats these as one input to the trust score, not as the only truth, because providers disagree and some egress networks are noisy by design.
An intermediary server that forwards traffic on behalf of the client.
Some proxies are privacy or infrastructure tools; others are used for automation, scraping, or fraud. Detection is imperfect because residential proxies, enterprise gateways, and cloud egress can overlap in behavior. Pixelscan surfaces proxy-related hints but does not claim perfect attribution.
Characteristics of a TLS handshake, such as protocol version or cipher selection, that can hint at the client or its network path.
Some detection systems use richer TLS hashes like JA3 or JA4. Pixelscan currently exposes lightweight TLS metadata from Cloudflare and leaves deeper TLS fingerprinting as partial or future-facing surface area rather than pretending it already has a definitive answer.
Pixelscan's 0-100 summary score for the current session.
The score blends IP reputation, privacy flags, leak findings, and consistency signals into one number with a verdict such as Clean, Suspicious, or Bot. It is a convenience summary for investigation, not a legal, fraud, or identity decision by itself.
A browser-supplied string that identifies the browser, operating system, and sometimes device family.
User agents are easy to spoof, so they are high-value but low-trust fields. Pixelscan still shows them because they remain operationally important, then compares them against platform hints and hardware-related fields to catch obvious mismatches.
A network tunnel that changes the apparent public IP and can protect traffic in transit.
A VPN does not automatically hide every signal. Browser fingerprints, WebRTC behavior, DNS routing, and datacenter egress can still expose a setup as unusual. Pixelscan therefore treats VPN detection as one surface inside a broader scan instead of a standalone yes-or-no answer.
A browser fingerprint derived from GPU-related rendering behavior and WebGL-reported capabilities.
WebGL output can reveal GPU family, driver quirks, and rendering differences that are hard to fake consistently. It is useful for spotting remote browsers, unusual virtualized stacks, or anti-detect setups, but it can also vary with normal driver and browser changes.
A case where WebRTC peer-connection discovery reveals a public IP that differs from the one the page sees for the current request.
WebRTC uses STUN to discover candidate network paths. If that discovery exposes an IP that bypasses a VPN or proxy, the rest of the site may see one address while WebRTC reveals another. Pixelscan compares the discovered candidates against the current request IP before calling it a leak.