Question 1

What is Trust Score?

Accepted Answer

A 0–100 measure of how natural your browser and network look to anti-fraud systems and trackers.

• F-Score (Fingerprint) — Canvas, WebGL, WebGPU, Audio, fonts, screen
• C-Score (Consistency) — timezone vs IP, UA vs OS, language vs region
• A-Score (Anonymizer) — VPN, Tor, datacenter / residential heuristics, JA4 TLS
• Above 85 looks like a regular user. Below 50 will likely get flagged.

Question 2

Why is my Trust Score below 100?

Accepted Answer

WHOX detected something off about your profile. The usual suspects:

• Commercial VPN or proxy IP (−15 to −30)
• Tor exit node (−25 to −40)
• Browser timezone doesn't match VPN country
• WebRTC or DNS leak through the tunnel
• Canvas / WebGL blocking — the modification itself is suspicious
• Headless mode or Selenium / Puppeteer signatures

Question 3

What does F / C / A actually mean?

Accepted Answer

Three independent axes of Trust Score, each catching a different class of detection.

• F — Fingerprint: Canvas, WebGL, WebGPU, Audio, fonts, screen, pixel density
• C — Consistency: timezone, language, OS markers, declared vs actual
• A — Anonymizer: VPN / Tor / proxy / datacenter, plus JA4 / JA4H TLS fingerprint
• Trust Score is the rolled-up view; F/C/A tells you exactly which axis hurts.

Question 4

How do I improve Trust Score?

Accepted Answer

Fix the failed checks shown in System Screening. Three angles to push:

• A-Score: residential VPN over datacenter, no WebRTC / DNS leaks
• C-Score: align browser timezone with VPN country, language with region
• F-Score: don't fully block Canvas / WebGL — that's an anomaly. Use Vigil for graceful spoofing.
• Run Deep Scan after every VPN or browser-config change to catch hidden leaks.

Question 5

Why is a perfect 100 nearly impossible?

Accepted Answer

Real users almost always trigger at least one heuristic. 100 means zero detectable signals, which itself is suspicious.

• Even residential ISPs surface signals (CGNAT, common subnet)
• Browser extensions modify Canvas / fonts (−2 to −5)
• Localized OS strings or rare locales nudge C-Score
• Exotic GPUs / WebGL drivers can flag F-Score
• A score of 92–98 is typical for a clean, naked browser

Question 6

How does Deep Scan work?

Accepted Answer

A 5–7 second active probe that finds leaks a passive scan can't see.

• WebRTC IP leak via STUN / TURN
• DNS resolver country mismatch (incl. DoH and DoT)
• Canvas / WebGPU shader integrity vs your declared GPU
• Typical proxy ports — SOCKS 1080, HTTP 3128 / 8080 / 8443
• On mobile: accelerometer + gyroscope physics check

Question 7

Quick scan vs Deep Scan — which do I need?

Accepted Answer

Quick = passive, Deep = active. Many critical leaks only show under active probing.

• WebRTC: STUN / TURN probes for real IP behind VPN
• DNS: where requests really go (incl. DoH and DoT)
• IPv6 leak — many VPNs tunnel only IPv4
• QUIC / HTTP/3 leak via UDP outside the tunnel
• mDNS leak — local hostname exposure

Question 8

How is WHOX different from other IP check sites?

Accepted Answer

Most services show 5–10 basic parameters. WHOX runs 300+ signals across 9 categories.

• JA4 / JA4H TLS fingerprints
• HTTP/2 SETTINGS frame fingerprint
• WebGPU shader fingerprint — not done by other public services
• Canvas integrity (not just hash — has it been tampered with?)
• Mobile sensor authenticity — accelerometer / gyroscope physics
• Cross-signal consistency (UA ↔ Client Hints, GPU ↔ Canvas, TZ ↔ GeoIP)

Question 9

What is WHOX Foresight?

Accepted Answer

A second layer beyond Trust Score: how Traceable and how Authentic your profile looks.

• Traceability — fingerprint rarity, cross-session links, Hardware DNA
• Authenticity — does this look like a real human, or a bot farm / anti-detect?
• Digital Shadow — sessions, IPs, countries and VPN providers linked to your fingerprint over time
• Hardware DNA — GPU / audio / CPU signatures that anti-detect browsers cannot spoof

Question 10

What are JA3 and JA4 fingerprints?

Accepted Answer

TLS-level browser fingerprints that identify which engine actually opened the connection — independent of User-Agent.

• JA4 hashes ClientHello: cipher list, extensions, curves, ALPN
• JA4H — same idea applied to HTTP request headers
• Anti-detect tools mimic UA but rarely match TLS fingerprint
• 'Chrome' UA + curl-like JA4 = automation flag
• WHOX shows raw values plus the closest browser match

Question 11

Why test with a WebGPU shader?

Accepted Answer

Pixel-level rendering of a calibrated shader catches fingerprint spoofing that fools Canvas-only checks.

• We render a known shader and compare against the declared GPU
• Anti-detect browsers emulate Canvas but rarely WebGPU
• VM GPUs (llvmpipe, virtio-gpu) have telltale shader output
• Mismatch → F-Score penalty. No other public service runs this check.
• Falls back gracefully on browsers without WebGPU support

Question 12

Does WHOX store my data?

Accepted Answer

No registration, no PII. Fingerprints are hashed in your browser; raw values never leave the device.

• Canvas / WebGL / Audio: SHA-256 hashed client-side, only short digests sent
• No names, emails, phone numbers, GPS coordinates ever collected
• No tracking cookies, no ad SDKs, no cross-context behavioural tracking
• Per-scan reqId is opaque and can't be linked to your identity
• IP logs kept 30 days for abuse prevention, then irreversibly purged

Question 13

Are you GDPR / CCPA compliant?

Accepted Answer

Yes. WHOX Limited is a Delaware company. GDPR legal basis is legitimate interest, no sale of personal information under CCPA.

• GDPR: full DSR rights — access, deletion, rectification, portability, objection
• CCPA: no sale of personal info, no cross-context behavioural advertising
• TLS 1.3 in transit, AES-256 at rest, regular pen-tests
• IP geolocation done locally via MaxMind — no data sent to third parties
• Privacy contact: support@whox.com

Question 14

How long do you keep my data?

Accepted Answer

30 days for sessions and request logs. 365 days for fingerprint hashes only (no reversible data). Aggregate stats may persist longer.

• Session data (hashed components + metadata): 30 days, auto-purged
• Request logs (full IP, UA, timestamp): 30 days, used only for abuse prevention
• Fingerprint hashes (SHA-256, no reversible material): 365 days
• Fully anonymized aggregates ("X% of users have Y"): retained indefinitely
• Deletion requests: support@whox.com

Question 15

Can WHOX link me across the sites that use it?

Accepted Answer

No. Each customer has its own req_id namespace. The same browser shows up as two unrelated digests across two customers.

• Cross-customer reputation pools are explicitly not in WHOX's design
• GDPR + PIPL treat persistent cross-site identifiers as personal data
• Customers needing pooled reputation pair WHOX with separate blocklists (MaxMind etc.)
• WHOX is per-session, per-tenant — not a tracking network

Question 16

Does WHOX work on mobile?

Accepted Answer

Yes — same desktop scans plus mobile-specific sensor checks. Score may differ from desktop and that's normal.

• Accelerometer + gyroscope physics validation (catches BlueStacks-class emulators)
• Screen + pixel density profiling
• Touch API authenticity — real touch vs scripted
• Use Wi-Fi over mobile data — carrier NAT can distort port scans

Question 17

Why is my mobile score different from desktop?

Accepted Answer

Different APIs, different signal availability. Mobile WebRTC is more permissive, font lists are short.

• Limited WebGL Extensions reduce F-Score discriminators
• iOS Safari aggressively partitions APIs — fewer Canvas signals
• Touch + orientation APIs add new authenticity signals
• Carrier NAT can mask leaks, may inflate A-Score
• Compare scores on the same network to isolate device delta

Question 18

What is WHOX Vigil?

Accepted Answer

Our browser extension. Blocks trackers, spoofs fingerprints with real entropy, monitors censorship — no naive noise injection.

• Per-site fingerprint isolation with real entropy (not random noise)
• Tracker blocking via locally-stored rule sets — no browsing data sent
• Censorship monitor: anonymously probes site availability (status only)
• Trust Score recalculation against the WHOX API on demand
• Works fully offline for blocking + fingerprint protection

Question 19

How do I use the WHOX API?

Accepted Answer

Server-side, via your own backend. Free tier covers 1 000 requests. Currently invite-only — email api@whox.com to join.

• Browser SDK posts fingerprint to YOUR backend; backend forwards to /api/v1/fp/ingest
• Server-side API key — never exposed in DevTools
• Endpoints: /fp/ingest, /fp/result, /fp/deep, plus SSE for deep-scan progress
• Stable response: trust_score, per-category breakdown, flags, fp_digest
• <50 ms p95 on the fast path; deep scan is network-bound (1.5–4 s)

Question 20

When is WHOX the wrong tool?

Accepted Answer

Three honest cases: payment-card fraud at scale, regulated identity verification, and very-low-traffic experiments.

• Card fraud: dedicated risk APIs (cart, BIN, billing context) outperform fingerprints on that narrow problem
• KYC / AML: needs document scan + biometric liveness — WHOX detects "real human", not "which human"
• Sub-100 sessions/day: integration cost stays the same; DNSBL + UA allowlist may suffice early on
• Hybrid setups are common — WHOX per-session, MaxMind / commercial DBs for cross-tenant reputation

My IP

Why not 100?

Anonymizer

Fingerprint

Consistency

How to Fix

WHOX Foresight

WHOX VIGIL

WHOX Sigil

System Screening

Checks Overview

How We Test

All our tests

Network

Identity

Analysis

Security

Frequent questions, sharper answers.