The tools fraudsters use, the signals that give them away and the abuse they produce, in one sentence each. Each entry adds how the term shows up on a real signup, login or checkout and, where Maskbreak has one, the response field that carries it. Reviewed September 2026; facts about other companies link to their source.
An antidetect browser is a modified Chromium or Firefox build that gives every profile its own spoofed device fingerprint, cookies and storage, usually behind its own proxy, so one operator can run many accounts that look like separate devices.
It is sold openly for multi-account marketing and e-commerce work. Group-IB puts the line at use: legal for privacy and market research, illegal for fraud or for bypassing security systems. Names you will meet: Multilogin, Gologin (GoLogin), AdsPower, Dolphin{anty}, Kameleo and Incogniton; FraudFox, an early one, is reported discontinued. In a Maskbreak response a detected one reads device.antidetect: true with reason antidetect_browser, and blocks by default. More in the antidetect browser guide.
FraudFox was an early antidetect browser sold as a preconfigured Windows 7 virtual machine that spoofed the user agent, screen resolution, language and time zone.
It is reported discontinued (Pixelscan, May 2025), and the same write-up points readers to newer tools. Our antidetect browser directory lists the current ones, who makes them and what changed in 2026. The two pieces it bundled are still what Maskbreak reports: a virtual machine as device.virtual_machine (review on its own since 29 September 2026, never a block by itself) and a spoofed browser profile as device.antidetect (block by default).
Other antidetect browsers include Octo Browser, MoreLogin, Linken Sphere, GPM Login, Undetectable, VMLogin and Hidemyacc, plus Camoufox, an open-source Firefox build aimed at scraping and AI agents.
Octo and MoreLogin both appear in Proxyway’s May 2026 roundup, which carries affiliate links. Linken Sphere was first introduced on Russian-speaking underground forums in July 2017, per Recorded Future, and now sells openly from ls.app. The brand matters less than the job: each one still has to keep a single device story consistent.
Antidetect browser detection looks for a device profile that contradicts itself: graphics, font, hardware and time-zone values that could not all come from one real machine.
A profile that claims macOS but exposes the fonts of the Windows laptop underneath is a classic tell, though no longer a reliable one: Dolphin{anty} says its engine-level font spoofing is built to stop exactly that. The guide covers our live scans of Kameleo and Undetectable and what each layer flagged. Route on device.antidetect, not on tampering_score.
Browser tampering is altering a browser’s JavaScript APIs, user agent or graphics output so it impersonates a different device; tampering detection looks for the traces those edits leave.
A convincing spoof has to change many things at once: the UA string, the Sec-CH-UA Client Hints, navigator properties, canvas and WebGL output. One left behind can give the whole profile away. Maskbreak reports it as device.antidetect with reason antidetect_browser.
User-agent spoofing is sending a User-Agent header and navigator.userAgent that claim a different browser, operating system or version from the one actually running.
It takes no special tools: Chrome DevTools overrides the string and its Client Hints in a few clicks, and MDN calls UA-based detection unreliable. So detection treats the UA as a claim and tests it against what the browser does: a string that says Safari on an iPhone should not arrive from a page that answers navigator.userAgentData, a Chromium API Safari does not ship. Where Maskbreak’s device check catches the mismatch, it surfaces as browser tampering (device.antidetect).
An emulator is software that imitates another device, most often an Android phone running on a desktop computer, so one machine can pass as many separate phones.
Developers use them to test apps; fraud rings use them to open accounts that each claim a fresh handset. Maskbreak has a device.emulator field (reason emulator_detected, block when it fires), but it comes from a mobile-only device check. A browser visit usually carries no emulator result, so check device.checked_signals before reading a false as clean. A virtual machine is reported separately (virtual_machine) and on its own asks for review, never a block.
A cloud phone is an Android device hosted by a vendor and rented and controlled over the internet, so one operator can run many mobile accounts without owning the handsets.
Multilogin, MoreLogin and Gologin sell them next to their browser profiles, and Multilogin has called itself a cloud-phone platform since July 2026. Maskbreak has no cloud-phone signal of its own. What a browser visit from one still shows is the route it exits through (network.proxy, network.datacenter) and the device history in device.visitor_id.
Device fingerprinting recognises a browser and device from the characteristics it exposes, such as graphics, fonts and hardware, so a returning device can be identified after cookies are cleared.
Public libraries show the technique. OverpoweredJS, by Joe Rutkowski, is one: its open edition is licensed only for non-commercial use and only where users explicitly consent to tracking; its maker sells commercial licences and runs a prototype hosted API. In Maskbreak the result is device.visitor_id, times_seen and returning. Whether you may use it is also a privacy-law question.
Private browsing, or incognito mode, is a browser mode that discards the history, cookies and site storage of a session when its windows close.
Plenty of honest people use it, and it also clears the cookie a returning abuser would otherwise carry, which is one reason device recognition cannot rely on cookies. Maskbreak reports device.incognito with reason private_browsing and leaves the decision alone: context for a reviewer, not a verdict.
IP intelligence describes the network a request came through; device fingerprinting describes the browser and machine that sent it, so each one sees fraud the other misses.
A fake browser on a clean home line fools the network check. A real laptop behind a rented proxy fools the device check. Maskbreak returns both in one answer, as the network and device blocks.
A TLS fingerprint summarises the ClientHello a client sends when it opens an encrypted connection, which reflects the TLS library that built it rather than the browser it claims to be.
A Python script that sends a Chrome user agent still greets the server like Python. JA3 lost its stability when Chrome began shuffling extension order in January 2023; JA4 sorts them first. It cannot expose a Chromium-based fake browser that claims to be Chrome, because that sends Chrome’s real handshake; it helps when the claimed browser and the engine differ. One input, never the verdict.
A residential proxy routes traffic through an IP address that an internet provider assigned to a real home or mobile subscriber, so the request looks like it comes from an ordinary household connection.
The clean address is what the buyer pays for. On a live visit, when Maskbreak’s network intelligence recognises the exit, it sets network.proxy and reason proxy_detected (block by default) and names the proxy network in network.service when known. network.residential: true only means no proxy or cloud flag fired.
A residential proxy network is a commercial pool of household and mobile connections, often recruited through apps or SDKs that share the device’s bandwidth, rented out to route other people’s traffic.
Exits rotate per request or per session, so an IP blocklist entry is stale by the next attempt. Rotation changes the address, not the machine: the same device.visitor_id turning up behind many exits is the pattern to watch.
A datacenter proxy exits from addresses owned by hosting and cloud providers and gives itself away by who owns the network; a residential proxy exits from addresses an ISP gave to a household and usually does not.
A cloud-server address sets network.datacenter and reason datacenter_asn but stays allow on its own, because company networks and cloud desktops exit there too. A recognised proxy of either kind sets network.proxy and blocks by default.
An ISP proxy runs on a server in a data centre, not in anyone’s home, but uses an IP address registered to a consumer internet provider, so it looks residential while keeping one stable address.
Sellers call it “static residential”; Proxyway describes it as server-hosted but marked as belonging to a consumer ISP. It suits keeping one account on one address for a long time, and the network owner will not give it away. Judge it by the proxy signal and the device, not the registry entry.
A mobile proxy exits through a cellular (4G or 5G) connection, usually a SIM in a modem or phone, so the website sees an address that belongs to a mobile carrier.
Carriers put many subscribers behind one public address (carrier-grade NAT), so banning a mobile IP also bans the real customers sharing it. That is much of the appeal. Answer with device evidence and a review queue, not IP bans.
Proxy detection determines whether a visitor is connecting through an intermediary server that hides their real IP address, and what kind of proxy it is.
It earns its keep against payment fraud at checkout and against fake accounts at signup: card testers and account farms spread attempts across proxy exits so each one looks like a different household. Maskbreak flags a recognised proxy on a live visit (network.proxy, reason proxy_detected, block by default; Apple’s iCloud Private Relay gets network.privacy_relay and reason privacy_relay, and review instead); a bare-IP lookup covers only Tor exits and published cloud ranges.
Residential proxy detection identifies traffic relayed through a home or mobile IP address, which usually means looking past the address to the connection and the device behind it.
Blocking residential networks blocks your own customers. The guide works up a ladder instead: a home-line exit starts at allow and moves up only when an independent signal, such as a fake browser, a time-zone mismatch or one device behind many exits, agrees.
A time-zone mismatch is a browser clock set to a time zone in a different country from the one its IP address is in.
Behind a home-looking address it can be the one clue to a proxy the network check did not recognise, or to a fake browser profile set up for a different exit. It is also what a traveller looks like. Send the browser’s zone as tz in the HTTP call (the current server SDKs do not accept it) and Maskbreak adds reason timezone_mismatch, which moves an allow to review and never blocks on its own. Behind a VPN, proxy, Tor or cloud exit the check is skipped, because there a mismatch is expected.
VPN detection identifies a visitor connecting through a virtual private network, and names the VPN service when known.
Plenty of honest customers use a VPN, so on its own it should mean review, not block. Maskbreak sets network.vpn, reason vpn_detected, and the operator in network.service when known.
A Tor exit node is the last relay in the Tor network, the address a website sees instead of the visitor’s; detection matches the connecting address against the current published exit list.
It is one of the few checks a bare IP answers well, so it works in the free IP lookup too. Maskbreak: network.tor, reason tor_exit_node, block by default. If your users need Tor, a Rules-tab rule can set it to review, but a matching rule sets the decision for the whole visit: a Tor visit that also shows automation then lands in review too, unless an automation rule says block.
IP reputation is an assessment of how risky an IP address is, based on what is known about it: whether it belongs to a VPN, a proxy, a Tor exit or a cloud server, and whether it sits on threat blocklists.
Its weak spot is rotation: a residential exit has no history worth scoring. A bare-IP lookup in Maskbreak covers only Tor exits and cloud ranges; VPN and proxy verdicts come from a live visit.
Bot detection separates requests made by software from those made by a person in a browser, so automated signups, logins and scraping can be slowed or stopped.
The evidence comes from both ends: automation traces inside the browser (device.automation, reason automation_detected, block by default) and where the traffic comes from, such as cloud servers and proxies.
Bot detection without CAPTCHAs decides on the server, from network, browser and behaviour evidence, whether a request is automated, instead of asking the visitor to solve a puzzle.
Real visitors never see a challenge, and there is nothing for a solving service to farm out. Your server asks before the protected action and gets allow, review or block back.
A headless browser is a real browser engine running without a visible window, usually driven by a script; headless Chrome is the common case.
The early tells, navigator.webdriver and a “HeadlessChrome” user agent, are patched away by stealth plugins. What is left is how the browser renders and behaves. The guide covers the checks that still work in 2026.
Puppeteer and Playwright are libraries that drive a real browser from code; detecting them means finding the traces that remote control leaves in the page, the input and the rendering.
They are the usual engines behind scrapers and signup bots, and the major antidetect browsers advertise built-in support for them. Where Maskbreak’s device check sees them, the answer carries device.automation.
A CAPTCHA farm is a paid service in which people or software solve CAPTCHA challenges on behalf of bots, typically for a fraction of a cent per solve.
At that price a CAPTCHA is a cost line for the attacker, not a wall. Evidence the solver cannot supply, such as the browser the bot runs in and the network it uses, still counts.
AI agent traffic is browsing done by an AI assistant on a person’s behalf, such as comparing prices or filling a cart; it is automated, but not necessarily hostile.
“Human or bot” stops being the useful question. An automation signal says software drove the browser, not which model drove it or why. Antidetect vendors sell agent control too: AdsPower launched an AI Agent in September 2026, and Multilogin open-sourced one that runs accounts on its Android cloud phones.
An AI agent policy is a site’s rule for assistants that browse and act for users (allow, rate-limit, challenge or block), decided by how risky the requested action is.
Reading a product page and opening an account are different questions. In Maskbreak the lever is the Rules tab, where the automation signal can be set to allow, review or block. A matching rule sets the decision for the whole visit, so relaxing automation also relaxes an automated visit that arrives through a proxy, unless a proxy rule says block.
Account takeover is an attacker gaining control of someone else’s account, usually by signing in with stolen or guessed credentials, or by reusing a stolen session.
At the login form the tells are a proxy or Tor exit, automation and a fake browser, and a correct password removes none of them. In a Maskbreak response those read proxy_detected, tor_exit_node, automation_detected and antidetect_browser, each a block by default. Stolen sessions are sold ready to use: Genesis Market sold victims’ fingerprints, cookies and saved logins until an FBI and Dutch police-led operation across 17 countries shut it down in April 2023. A visitor check sits beside MFA and session controls, not in their place. Playbook: stop account takeover.
Credential stuffing is replaying username and password pairs leaked from other sites against your login form, automatically and at scale, betting that people reuse passwords.
OWASP calls it the automated injection of stolen credential pairs. Runs are spread over rotating residential proxies, so each address sends a trickle; count attempts per device (device.visitor_id) and per account, not per IP. More in stuffing behind residential proxies.
Card testing is running many small, automated payments or authorisations to find out which stolen card numbers still work.
It shows up as bursts of small charges with high decline rates, many cards tried from one device, and exits spread across proxies. Count cards per device.visitor_id, not per IP; a recognised proxy exit adds proxy_detected, a block by default. Playbook: stop card testing.
A BIN attack is card testing with generated numbers: the attacker takes a card issuer’s public Bank Identification Number (the first 6 or 8 digits) and guesses the rest, then checks the guesses with small payments.
Definition per Checkout.com. The pattern, one prefix and hundreds of generated numbers, lives in your payment processor’s data rather than in a visitor check; what the check adds is whether those sessions arrive through proxies or automation.
Carding is using stolen card details to buy goods, gift cards or account credit, usually after card testing has shown which cards still work.
The carder wants to look like the cardholder, so the purchase often comes through a residential proxy near the billing address, which is why the IP looks clean. A recognised proxy blocks by default in Maskbreak; the order itself stays with your payment processor’s fraud tools. Related: gift card fraud.
Chargeback fraud is a card payment that ends in a dispute because it was fraudulent: a stolen card used by someone else, or a cardholder falsely disputing a purchase they made.
The stolen-card kind often leaves evidence at checkout: a proxy exit, a fake browser, one device behind many accounts. Maskbreak does not score orders or guarantee chargebacks; it gives you that session evidence before you ship.
Friendly fraud is a cardholder disputing a legitimate purchase that they, or someone in their household, made; Visa also calls it first-party misuse.
Fraud signals rarely help, because the real customer was on their real connection. Records do: under Visa’s Compelling Evidence 3.0 a merchant can point to at least two undisputed transactions more than 120 days old with a matching IP address or device ID, so keep both with every order.
Free-trial abuse is one person signing up again and again with new emails, browsers or IP addresses to keep using a free trial without paying.
Send your accountId with the check and Maskbreak counts the accounts linked to that device (device.linked_accounts, reason multi_account_device), within your own account only. A disposable email moves an allow to review. Playbook: stop trial abuse.
Bonus abuse is claiming a sign-up, deposit or referral bonus more times than the terms allow, usually through several accounts run by one person or one team.
Check at the claim, not only at signup: many new accounts, one device, fresh proxy exits and often a fake browser per account. Send your accountId with the check and device.linked_accounts counts the accounts seen on that device (reason multi_account_device, which does not change the decision on its own). The tooling is not hidden; Dolphin{anty} lists “bonus hunting” among its use cases. Playbook: stop bonus abuse; related: referral fraud.
Multi-accounting is one person running many accounts on a service that expects one per person, to claim trials, promotions, referrals or votes more than once.
Proxies split the accounts by address and fake browsers split them by fingerprint, which is why the fake browser is itself a signal. Maskbreak sets device.multi_account when one device is linked to more than one of your accounts, stored as one-way hashes and never compared across customers.
Synthetic identity fraud is inventing a person from a mix of real and made-up personal data, such as a genuine Social Security number with a false name and date of birth, then using it to open accounts or obtain credit.
The Federal Reserve’s definition covers fabricated persons and entities. Catching it is a KYC and credit-bureau job, which Maskbreak does not do; a visitor check can add that one device keeps applying under different names.
A disposable email address comes from a throwaway inbox service, receives mail for minutes or days, and lets someone pass email verification without giving a lasting address.
Send email with the check and Maskbreak adds reason disposable_email, which moves an allow to review. It checks the domain against a disposable-domain list, not mailbox ownership or sender reputation. How the lists work.
A fraud detection API is a service your server calls before a sensitive action, such as signup, login or checkout, and that returns a risk decision or score for that visitor.
Compare them by what each can see: the network, the browser, the payment or the identity document. Maskbreak answers with decision, risk_score and reasons from one server-side check; the API docs list every field.
A risk score is a number that sums up how much risk evidence one visit carries; Maskbreak’s risk_score runs from 0 to 100 as a weighted sum of the signals that fired.
Route on decision, not on a threshold of your own: a VPN alone scores 35 and comes back review, a proxy alone scores 50 and comes back block, and when no network or device threat fires, the engine caps the score at 15. The optional email (+15) and time-zone (+25) signals can add to that and move an allow to review. It is not a probability of fraud.
A velocity check counts how often something repeats within a time window (signups per device, logins per account, card attempts per session) and acts when the count passes a limit.
Count on keys that survive rotation: per-IP counters miss attacks spread over proxy pools, while the device and the account change less easily. Maskbreak supplies the key (device.visitor_id) and an informational high_activity_device reason; the counters and limits live in your app.
Watch mode is running a fraud check on live traffic while only logging its decision, so you see what it would allow, review and block before any customer is affected.
It is step one of Maskbreak’s integration guide (MASKBREAK_MODE=watch): log decision and reasons, always continue, and switch to enforce once the Events tab looks right.
A fake browser behind a residential proxy, checked at signup. Proxy detection, antidetect browser detection, the visitor ID from device fingerprinting and the risk score all land in one answer:
Example response, selected fields. Either reason would block on its own under the default policy, and the score is clamped at 100. Swap the proxy for a VPN on a clean browser and the same check reads vpn_detected and comes back review, because a VPN on its own is flagged, not blocked.