One API call catches bots, fake browsers, VPNs and proxies before they get in. Each check returns allow, review or block.
Free plan: 10,000 checks a monthNo credit cardNo sales call
Instant API key. Setup starts in watch mode: it blocks no one until you turn blocking on.
A real check of your visit. No signup needed.
Your app gets a simple answer: continue, double-check or stop.
{
"decision": "review",
"risk_score": 65,
"network": {
"vpn": true,
"service": "PROTON_VPN"
},
"reasons": [
"vpn_detected",
"datacenter_asn"
]
}Use Maskbreak instead of IP-only screening when you need network and browser signals in one visit check. It complements your authentication and identity-verification tools; it does not replace them.
Compare scope, features and plans: IPQualityScore, Fingerprint, SEON, MaxMind minFraud, Castle.
Under the hood
Large fraud teams pay enterprise prices for this grade of detection. Maskbreak pairs device fingerprinting, which recognises the device itself, with VPN and proxy detection, which reads the live connection. Every plan includes both, the Free plan too.
Recognises the device itself, not a cookie that can be deleted.
device.visitor_iddevice.antidetect
Checks the connection of the live visit, not just a list of addresses.
network.proxynetwork.vpnnetwork.service
The device check also spots headless browsers and automation tools such as Puppeteer and Playwright, and recommends a block by default.
device.automation
New in your dashboard
Paste an email address or a phone number into your dashboard and see what a fraud team would look at: whether the address is real and long-used, whether the number is a real mobile line or a throwaway internet number, and whether other businesses have reported it as fraud.
In every plan: 3 checks a day on Free, 20 on Starter, 50 on Growth and 150 on Scale.
Try it freeUse cases
Most abuse starts with a visit that isn’t what it claims to be: a script, a hidden connection or a browser in disguise. Check the visit before you create the account, accept the login or take the payment.
Scripts and account farms sign up in bulk for free credits, spam or resale. Automated signups are blocked, and a throwaway email address adds a flag.
Read the playbookCredential-stuffing tools try stolen passwords through rented proxies. Stop the attempt before it reaches your password check.
Read the playbookThe same person comes back with a new email address for another free trial or sign-up bonus. A VPN, a throwaway address or a device you have seen before gives them away.
Read the playbookBots try stolen cards with small payments. Checking the visit first stops scripted attempts before they reach your checkout.
Read the playbook"decision": "block" "reasons": ["automation_detected", "disposable_email"]
"decision": "block" "reasons": ["proxy_detected"]
"decision": "review" "reasons": ["vpn_detected", "disposable_email"]
"decision": "block" "reasons": ["proxy_detected", "automation_detected"]
An illustration. Your own visit is checked live at the top of this page.
How it decides
Your app gets one of three answers, with the reasons behind it. You decide what each one means on your site.
A visit with no detected warning signs
Let the person carry on with their signup, login or purchase.
A person using a VPN
A VPN is not proof of fraud. Your app can ask for an extra check, such as an email code.
A browser showing signs of tampering
Your server can stop the action and explain what the visitor should do next.
These are recommendations, not proof of who someone is. Missing checks are reported as incomplete—not quietly treated as safe. Read the decision policy →
For developers
Maskbreak is a tool for website owners and developers. You do not need to replace your login or checkout.
Get a free API key. This lets your server ask Maskbreak about a visit.
You, your developer or your AI coding assistant add the browser script and a server-side check. Keep the API key on your server.
Your server receives the recommendation and its reasons. Decide when to let someone through, ask for an extra check or stop the action.
// Your server, after the form posts: ask about this visit
const r = await fetch('https://maskbreak.com/v1/evaluate', {
method: 'POST',
headers: {
Authorization: 'Bearer ' + process.env.MASKBREAK_API_KEY,
'Content-Type': 'application/json'
},
body: JSON.stringify({ token, fingerprintEventId })
});
const { decision, reasons } = await r.json();
console.log('[maskbreak]', decision, reasons);
// Watch mode (the default) only logs.
// Set MASKBREAK_MODE=enforce to act on it.
if (process.env.MASKBREAK_MODE === 'enforce') {
if (decision === 'block') return refuse(reasons);
if (decision === 'review') return askForEmailCode();
}{
"decision": "review",
"risk_score": 65,
"network": {
"vpn": true,
"proxy": false,
"datacenter": true,
"service": "PROTON_VPN"
},
"reasons": ["vpn_detected", "datacenter_asn"]
}Want the technical details? Visit checks vs. IP lookups How to test VPN detection
Privacy
Fraud checks handle personal data. Here is what happens to it.
In your stored checks, each visitor’s IP address is replaced with a keyed one-way hash after 7 days.
Linked accounts are counted only inside your own Maskbreak account, linked by keyed hashes and never matched across customers.
Read the data processing agreement, the sub-processor list and the security whitepaper before you sign up.
Data processing agreement Sub-processors Security whitepaper
The practical side
Integration guide · EnglishWhat the browser can tell you, what needs your server, and where the check belongs.
Read the guide
Testing guide · EnglishReal profiles, missed detections and missing checks. A practical test plan, not a promise of perfection.
Read the guide
Live test · EnglishA default profile behind ExpressVPN, flagged for review on its first visit: the VPN named, the browser read as a virtual machine.
See the test
Live test · EnglishSold as a real phone with a real SIM, its exit on Telia’s network. What a mobile proxy is and what caught this one.
See the testBefore you integrate
Maskbreak's Free plan includes 10,000 visitor checks a month with no credit card required; integration is a browser script and a server-side API request, and paid plans start at €29 a month. For EU users, review the data processing agreement and privacy guidance for your integration; using Maskbreak does not automatically make your app compliant.
Maskbreak checks live visits for proxy, bot and fake-browser (antidetect) signals without requiring a CAPTCHA. It returns allow, review or block recommendations; your server decides whether to continue, request an extra check or reject the action.
Maskbreak works with Node.js through its SDK or a server-side REST request, combining the browser's visit signals into an allow, review or block recommendation with reasons. Start on the Free plan with 10,000 visitor checks a month and keep your API key on the server.