How to detect Gologin in 2026
Gologin (older pages write GoLogin) is an antidetect browser, the kind of fake browser that gives every profile its own device fingerprint, cookies and proxy. Its own site calls it an "antidetect browser to manage multiple accounts". Profiles run in Orbita, Gologin's Chromium-based browser, and sync through Gologin's cloud, so a teammate can pick up the same session on another device. Maskbreak does not look for Gologin by name. It checks whether the browser's claims hold up, whether a script is driving it and where the connection comes from, and a fake browser gets block by default.
What Gologin is
This is the product as Gologin's own site described it in September 2026. Profiles live in the cloud and can be shared with team members at different access levels. Cloud Browser is "a full web browser that runs on a remote server", and Playwright and Puppeteer connect to it over CDP. Cloud Android offers virtual Android phones hosted on remote servers for accounts that live in mobile apps, and there is also an Android app and a Browser MCP for AI agents. The free plan gives 3 browser profiles, without profile sharing or team members. Paid plans are priced by profile count, from 10 profiles on the smallest plan up to custom plans of 2,000 and more, with rotating discounts, so read the current figures on Gologin's pricing page. The site footer names SCALEHAT LLC as the maker. Updates come often: the release notes list several app releases a month, and the Android app moved to Chromium 151 on 3 September 2026.
Where Gologin sessions give themselves away
No single check is enough, and none of them looks for Gologin's name. Each visitor check tests four things separately: whether the browser's claims fit its engine and hardware, whether a script is driving it, where the connection comes from, and whether the same device keeps coming back under different accounts. A clean answer on one does not cancel a flag on another; any one block signal blocks.
device.antidetect, adds the reason antidetect_browser and returns block by default, whichever profile is loaded. It flags the class of tool, not the product, and a profile that contradicts nothing measurable passes this check.device.tampering_score is a 0–1 value from the device check, not a probability of fraud. On our test bench it read the same near-zero value on a clean browser and on every spoofed profile, while the fake-browser flag moved. Route on decision and reasons; do not build a cutoff on the score.device.automation, adds automation_detected and blocks by default. It does not name the framework; bot detection covers the signal in full.network.datacenter is true and datacenter_asn is listed; a virtual machine shows as device.virtual_machine. Neither blocks on its own, because real users reach sites from cloud servers too and developers browse from virtual machines: a cloud-server address alone is allowed, and a virtual machine alone asks for review. Both add to risk_score next to a signal that does.proxy_detected and blocks by default, and a VPN on its own adds vpn_detected and is flagged for review. network.service names the operator when known. A residential proxy it does not recognise looks like a home connection, which is why the device check carries the weight here.accountId with each check and device.linked_accounts counts how many of your accounts this device has been used for. More than one adds multi_account_device, which leaves the decision alone unless you set a rule for it. Links stay inside your account, stored as one-way hashes. device.times_seen is different: it counts sightings across all Maskbreak customers, not only yours. Profile switchers are built to beat linking, and a new profile can arrive as a new device, so treat this as an extra layer, not the main one.engine_decision keeps the default whenever a rule changed the answer.Wiring it in
Add Maskbreak's browser snippet to the forms where accounts are created or money moves: signup, login, checkout, a bonus claim. Your server forwards the two tokens it collects to POST /v1/evaluate with your API key, and one response carries the decision, the reasons, device.antidetect, device.automation, the network flags and, when you send an accountId, the account links. Start in watch mode, which logs every decision and lets the visitor through, and switch to enforce once the Events log looks right. The quickstart has the handler and the API reference lists every field. For background, see the antidetect browser hub, our antidetect lab notes, block or review antidetect browsers? and our Gologin write-up.
Free plan: 10,000 visitor checks a month, every signal included, no card. Paid plans from €29 a month.