Stop Bonus Farming, Referral Fraud & Multi-Account Promo Abuse
Bonus abusers run fake browsers (antidetect browsers) behind residential proxies to claim every deposit match, signup bonus and referral reward you fund: dozens of accounts, one operator. Maskbreak checks the visit at signup and again at the claim, blocks the proxy and the fake browser by default, and tells you how many of your accounts the device has already used. One server-side call, nothing for the player to solve.
What you're up against
Deposit-match farming with fake browsers
One operator runs dozens of accounts through Kameleo or Dolphin Anty profiles, each claiming your new-depositor match, placing a hedge bet and withdrawing. Each account can pass KYC because the identities are real, bought or borrowed. What they share is the operator and the machine.
Referral programs paying the same person twice
Fintech and marketplace referral rewards get farmed by self-referral: new email, new phone number, new residential IP, same laptop. Uniqueness checks watch the identity layer while nobody watches the device.
Residential proxies beat IP velocity rules
Commercial residential proxy networks hand each signup a clean home IP in your target market, so IP-based limits and geo checks see nothing wrong. Static blocklists struggle because the exits rotate faster than most lists update.
Every account survives manual review
In isolation each abusive account looks like a legitimate new customer, so flagged cases get cleared and the payout goes through. The pattern only exists across accounts, and nothing in your stack links them together.
What Maskbreak does for you
- Send your account ID with each check and read
device.linked_accounts: how many of your accounts this device has used, withmulti_account_devicein the reasons when it is more than one - Flag fake browsers (
antidetect_browser) and emulators (emulator_detected), both blocked by default, at signup and again at the bonus claim - Flag proxies, residential ones included (
proxy_detected, block by default), and VPNs (vpn_detected, review), naming the service when known - Gate referral payouts on device evidence as well as email or phone uniqueness
- Return a verdict from one server-side call: no CAPTCHA, nothing for a genuine player to solve
behind dozens of bonus accounts is the tell. A worked model of a sportsbook facing a ring of fake browsers on residential proxies, and where the checks stop it. Illustrative scenario, not a customer result.
Read the PlaybookWhere the check goes
The call site that matters most is the bonus-claim or promo-redemption endpoint — gate the credit itself, so an account that slipped through signup still can't get paid. Add the same check at signup and referral payout, send the account's ID as accountId each time, and the device claiming reward after reward shows up in device.linked_accounts before any money moves. The client snippet rides in your existing pages; the server asks Maskbreak for a verdict before the credit is applied. The example starts in watch mode: it logs each verdict with the linked-account count, lets every request through and fails open if Maskbreak is unreachable. After a few days, compare the log with the Events in your dashboard, pick your own linked-account limit, then uncomment the enforce line; the integration guide has the full enforce checks.
// Gate bonus claims before crediting the deposit match // Watch mode first: log the verdict, always continue, fail open const body = req.body || {}; // sentinel.js adds monocle + sentinel_fp to your form let risk = null; try { const verdictRes = await fetch('https://maskbreak.com/v1/evaluate', { method: 'POST', signal: AbortSignal.timeout(5000), headers: { 'Authorization': 'Bearer ' + process.env.MASKBREAK_API_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ token: body.token || body.monocle, // network evidence fingerprintEventId: body.fingerprintEventId || body.sentinel_fp, // device evidence tz: body.tz || body.sentinel_tz, accountId: req.user?.id // the claiming account; hashed, counted in your account only }) }); if (verdictRes.ok) risk = await verdictRes.json(); } catch {} // unreachable or timed out: your handler still runs console.log('[maskbreak]', JSON.stringify({ decision: risk?.decision ?? null, reasons: risk?.reasons ?? null, risk_score: risk?.risk_score ?? null, degraded: risk ? !!risk.degraded : null, linked_accounts: risk?.device?.linked_accounts ?? null })); // Enforce later: if (risk?.decision === 'block') return res.status(403).json({ error: 'Request rejected' }); // Then hold the credit for review when risk?.device?.linked_accounts passes your own limit
The signals that matter here
Example response for a bonus claim from a fake-browser profile behind a residential proxy, on a device already used with three of your accounts (excerpt, illustrative values):
{
"decision": "block",
"risk_score": 93,
"reasons": ["proxy_detected", "antidetect_browser", "multi_account_device"],
"network": { "vpn": false, "proxy": true, "datacenter": false, "tor": false, "residential": false, "service": null },
"device": { "antidetect": true, "automation": false, "emulator": false, "tampering_score": 0.8, "linked_accounts": 3, "multi_account": true }
}One operator, many verified identities. Bonus farmers can pass KYC because each identity is real; the abuse only shows when accounts trace back to the same device. Send the claiming account's ID as accountId and, when the device check completes, device.linked_accounts counts how many of your accounts this device has been used with; above one, multi_account_device joins the reasons. It is reported, not enforced: the decision does not change by default, so set your own limit in the claim handler. The count lives in your account only, stored as one-way hashes, and never crosses to another customer. Do not read device.times_seen as that count: it tallies sightings of the device across all Maskbreak traffic. More on the pattern in iGaming bonus abuse detection.
Fake browsers leave traces of their own. Kameleo, GoLogin, Dolphin Anty and AdsPower change what canvas, WebGL and font checks report, and the changes can contradict each other. When Maskbreak's device check spots the tampering it returns antidetect_browser with device.tampering_score (0 to 1), and the default decision is block, however clean the rest of the session looks. A fresh profile is built to look like a new device and may get a new visitor_id; the tampering is what gives it away. A browser running inside an emulator returns emulator_detected, also a block. Background: what an antidetect browser is.
Residential doesn't mean real. A clean German home IP can be a residential proxy exit rented by the hour. Maskbreak's network intelligence looks past the address: a residential proxy it recognises comes back as network.proxy: true with network.residential: false and the reason proxy_detected, a block by default. A VPN returns vpn_detected and review. network.service names the proxy or VPN service when known.
Signals, not verdicts alone. Every response carries the decision (allow, review or block), a 0–100 risk_score and the reasons behind it. That allows asymmetric policy in your own code: lenient at login, where a VPN is often privacy hygiene, and strict at the bonus-claim and referral-payout endpoints. Rules-tab actions are different: they apply to every check on your account, and each one changes the decision only for the signal it names. A multi-account rule can raise a claim to review or block, and a proxy or fake browser on the same claim still blocks whatever that rule says. For a limit that holds only at the claim, apply your linked-account threshold in code.
Common questions
accountId with each check. The response then carries device.linked_accounts, the number of your accounts this device has been used with, and adds the multi_account_device reason when it is more than one. Links are stored as one-way hashes and counted within your account only; they never cross to another Maskbreak customer. device.times_seen is a different number: it counts sightings of the device across all Maskbreak traffic, so do not read it as your account count. A fresh fake-browser profile is built to look like a new device, which is why the profile itself is checked too: browser tampering returns antidetect_browser and blocks by default.antidetect_browser reason, a block by default, with device.tampering_score from 0 to 1. Results vary with the tool, its version and its settings, and no detection rate is published, which is why the verdict also weighs the network (proxy, VPN, Tor) rather than one flag.vpn_detected and network.service naming the VPN when known. Your code decides what review means at each endpoint: many operators let VPN-only traffic through at login and hold the bonus claim for a manual look. A proxy, Tor, a fake browser or an emulator is a block by default.accountId, goes in front of each payout; only the endpoint you protect changes.Make bonus farming unprofitable
Free plan: 10,000 visitor checks a month, no card. Paid plans from €29 a month. Flags residential proxies, fake browsers and automated browsers.