If you’re a data scraper and websites often block your scraping scripts, the problem might not be the script, but the browser you’re using.
Regular browsers aren’t made for privacy. They display everything about your system to the websites you’re visiting.
To know why exactly your scripts get blocked, you can run checks on your digital fingerprint using CreepJS, and it’ll most likely highlight the cause.
CreepJS is one of the most advanced fingerprint analysis tools that developers and other experts use. It can reveal a lot of issues in your fingerprint, which might be hindering you from surfing the internet freely without you knowing about it.
In this guide, you’ll learn how to pass CreepJS check using specialized anti detect browsers.
But before that, I’ll give you a brief overview of CreepJS and why regular browsers and basic fingerprint spoofing measures fail CreepJS.
What is CreepJS, And Why is it The Hardest Test To Pass?
CreepJS is an open-source fingerprint analysis tool. It was created and launched by Abraham Juliot in 2020. Since then, it has become a standard benchmark for developers, particularly web scrapers, to test if their anti-fingerprinting measures are working as expected.
An important thing to note here is that the official CreepJS project can only be accessed through this domain: https://abrahamjuliot.github.io/creepjs/. The rest of the websites, like CreepJS.org, are all knockoffs.
CreepJS doesn’t give you a verdict on your entire fingerprint like Pixelscan or Iphey. It isn’t like Browserleaks either, which just displays dozens of fingerprint parameters and leaves you to analyze and come to a conclusion.
CreepJS sits somewhere between these two categories of tools. It gives you the following confidence levels and displays all the fingerprint parameters that did or did not contribute to them for further analysis.
- Fingerprint uniqueness: The uniqueness of your fingerprint compared to others’ fingerprints. The more unique the fingerprint, the more common and less trackable your fingerprint is.
- Trust confidence: This is based on the inconsistencies/mismatches (lies) in your fingerprint found by CreepJS. When there are fewer inconsistencies, the confidence is high.
The check by CreepJS is so aggressive that a clean browser without any anti-fingerprinting measures or any history of malicious activity can struggle to get positive scores.
CreepJS is particularly effective at catching browsers using automation scripts. It performs separate checks for automation frameworks like Selenium, Puppeteer, and Playwright. This is the reason CreepJS is mostly used by web scrapers.
Why and Who Needs Device Fingerprints for Work?
Websites that you visit collect a bunch of information about your system, browser, software, and hardware. Then the platforms combine those data points to create a unique profile that can help identify and track your activity/behavior during your current and future visits.
This entirely happens silently without the knowledge of many users.
The purpose behind profiling visitors is usually to personalize the website’s content for each visitor and display targeted ads. But some websites may also sell your fingerprint info and your activity history to third parties (e.g., marketers, govt agencies) for various reasons.
Some privacy-conscious users or those from certain professions who are aware of the fingerprinting technique don’t like being tracked like that. To make it difficult for websites to identify them uniquely, they customize their fingerprint to make it less unique and trackable.
Now, different professionals have different reasons for changing their digital fingerprints.
The following are some professionals who customize their device fingerprints as part of their work:
- Data scrapers: Data scrapers use automated scripts to gather information from websites (e.g., e-commerce websites) at a massive scale. To avoid being blocked by anti-bot websites, they attach a human-looking fingerprint to their requests to appear like a normal human visitor. Tools like CreepJS help them make sure their tweaked fingerprint is working.
- People who manage multiple accounts on platforms: People such as e-commerce store managers create a unique browser fingerprint for every e-commerce store they manage for their clients. They do this because buying a separate device for each account to have a unique fingerprint isn’t cost-effective or practical.
- Affiliate marketers: Affiliate marketers customize their fingerprints (language, timezone, geolocation, etc) to look like they’re coming from the specific country they are targeting with an ad campaign. Otherwise, the platforms they work with might flag their activity as suspicious and block their accounts.
Why Basic Anti-Fingerprinting Fails CreepJS
CreepJS is made to see through basic fingerprint masking or customization tricks.
It takes the value of the variables reported by the browser and then inspects the JavaScript engine to see if it returns the same value for those variables. The tool probes the object prototypes to see if a native function has been tampered with or overwritten by a script.
If there’s a mismatch between the values returned by the sources, it can detect that the original fingerprint has been modified.
For instance, if you use a script written in JavaScript or some basic browser extension to hide your real graphics card, the native code can still highlight that there’s an error. CreepJS then traces the error back to the source through the stack trace.
Sometimes, fingerprint masking can be detected by comparing the values only.
For example, if you use a VPN to hide your actual IP and location, CreepJS can still get your actual public IP address from a WebRTC leak.
If your WebRTC isn’t leaking your real IP, CreepJS can simply compare your system clock with the timezone associated with your fake IP and show you a mismatch.
I used a VPN (IP: 86.62.29.57) and connected to a location in Boston. CreepJS was able to catch the mismatch between the IP’s timezone and the timezone associated with my system clock. Notice the IP address (Boston) and the timezone mentioned in the screenshot below.
These were just a few examples of how CreepJS can detect inconsistencies in your fingerprint. The actual techniques are more than that.
For example, websites can tell your real location by geolocating you, regardless of your VPN usage. You can also be caught through your language settings and the Intl API outputs (e.g., location being Germany but date and number formatting still in American English).
Despite all these anti browser fingerprint spoofing measures, you can still pass CreepJS checks on the condition that you use strong antidetect browsers like Gologin. Let’s show you how they can pass CreepJS despite using a proxy and a customized fingerprint.
Step-by-Step: How to Pass CreepJS and Eliminate Lie Flags Using Gologin
Gologin browser takes care of the consistency problem by making sure all your fingerprint parameters adjust when you customize a single parameter.
Gologin allows you to create an entirely new fingerprint when you create a browser profile using the software.
Let me show you how Gologin passes CreepJS even after I changed my fingerprint. Here are the steps I followed, and you can too:
1. Visit Gologin’s website, download and install Gologin desktop app for your specific operating system. Once the installation is finished, launch Gologin and sign up for a new account, and then log in.
2. Inside the browser dashboard, click the Add Profile button to start creating a new browser profile. You can also give the profile a name that helps you remember what you are using it for.
3. In the screen that pops up, you’ll see that Gologin has already automatically generated a natural-looking fingerprint for this profile. But you can customize this fingerprint manually.
4. Let’s start with changing our IP. Gologin allows you to use its built-in proxies, or you can add your own from a third-party provider by entering your credentials. I went with Gologin’s own proxy and chose the United Kingdom as the country for the proxy.
5. Click Create Profile and then hit the Run button to launch the newly created profile.
6. You will see a browser window open up that looks just like a standard version of Chrome. Head to the CreepJS website and let the fingerprint scan complete. Now, notice the timezone mentioned.
How did Gologin achieve this consistency? As I mentioned before, Gologin has measures in place that adjust related fingerprint parameters when you customize a fingerprint parameter.
So when you tweak your IP address, Gologin automatically adjusts other parameters that should change accordingly with the IP. These include the geolocation, IP leaked by WebRTC, system clock timezone, and languages.
If CreepJS still highlights any issues, you can go back into the profile settings and adjust the parameters relevant to the problem.
Gologin allows you to create as many browser profiles as you can and use each one of them for a different task. Each of these profiles can have different fingerprints from one another, but you will be managing them all from a single device and browser.
Start using Gologin today and stay undetected online.
Download Gologin for free and manage multiple accounts without bans!
FAQs
What is a prototype lie in a CreepJS check?
A prototype lie in CreepJS is when CreepJS detects that your browser is tampering with its own native functions. When a script overwrites or modifies a built-in browser API to fake a value, CreepJS examines the underlying code, sees that the original function was altered, and flags the mismatch as a lie.
Can regular browser automation tools pass the CreepJS test?
No, regular browser automation tools can not pass the CreepJS test. CreepJS runs individual checks for major browser automation frameworks such as Puppeteer, Playwright, and Selenium. So if you’re on a regular browser and you run automation scripts, the CreepJS test will detect you.
