Stop Multi-Accounting, Ban Evasion & Duplicate Account Farms
One operator with a fake (antidetect) browser and a rotating proxy list can look like fifty different users to your platform. Send your own account ID with each check and Maskbreak tells you how many of your accounts the device has used, and flags the tools used to look new — invisibly, in one server-side call.
What you're up against
Ban evasion with a fresh fingerprint
Ban a bad actor and they are back within the hour: new email, new residential IP, new browser profile from Kameleo or GoLogin. An IP ban or a cookie never sees the same "user" twice.
Referral and promo farming
One operator self-refers dozens of accounts to drain signup bonuses, referral rewards, and promo credits. Each account passes email verification and looks like an ordinary new user in isolation.
Sock-puppet reviews and engagement
Marketplace sellers review their own listings, community accounts upvote their own posts, and creator profiles inflate their numbers — all from one desk, spread across accounts your moderation tools treat as unrelated strangers.
One person, fifty accounts in your metrics
Duplicate accounts poison everything that assumes one account is one person: matchmaking and ranked ladders (smurfing), per-user limits, DAU numbers, and the trust systems your community depends on.
What Maskbreak does for you
- Send your own
accountIdwith each check and readdevice.linked_accounts: how many of your accounts have used this device. A new IP or email address does not reset it - Above one linked account,
multi_account_devicejoins the reasons. It changes nothing by default: your handler, or a rule you set, decides what it means - Flag fake (antidetect) browsers such as Kameleo, GoLogin and AdsPower by the marks their spoofing leaves:
antidetect_browser, blocked by default - Read proxy rotation on every live check: vpn, proxy, datacenter, residential and tor flags. A proxy blocks by default; a VPN on its own is flagged for review
- Check signups, logins and reward claims with one server-side call — no puzzle, no extra step for real users
behind a wave of pledges is the tell. A worked model of a creator platform hit by a coordinated ring on residential proxies, and the linked-account count that exposes it when the ring reuses devices. Illustrative scenario, not a customer result.
Read the PlaybookWhere the check goes
The call site that matters most is signup: send the id you are giving the new account as accountId, and device.linked_accounts says whether this is the first of your accounts on that device or the fifteenth. Use your own server-side id, never a value from the form. Add the same check at login and wherever value moves — referral redemptions, promo claims, payouts, ranked play — to catch operators who age accounts quietly before cashing in. Keep device.visitor_id with each account in your own database: when you ban an account, its visitor IDs become your ban list. Links are per customer: you see which of your own accounts share a device or an address, never another customer’s. Since 18 October 2026 the response also carries an account object, and three or more of your accounts on one device within 24 hours adds device_many_accounts and turns an allow into a review. The example starts in watch mode: it logs each verdict and the linked-account count, lets every request through and fails open if Maskbreak is unreachable. After a few days, compare the log with the Events in your dashboard, then switch on the enforce lines; the integration guide has the full enforce checks.
// Count this device's accounts before creating another // Watch mode first: log the verdict, always continue, fail open const body = req.body || {}; // sentinel.js adds monocle + sentinel_fp to your form const accountId = String(user.id); // your server-side id (at signup, the new account's), never a form field let risk = null; try { const verdictRes = await fetch('https://maskbreak.com/v1/evaluate', { method: 'POST', signal: AbortSignal.timeout(5000), headers: { 'Authorization': 'Bearer ' + process.env.MASKBREAK_API_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ token: body.token || body.monocle, // network evidence fingerprintEventId: body.fingerprintEventId || body.sentinel_fp, // device evidence tz: body.tz || body.sentinel_tz, accountId // links device and account, inside your account only }) }); if (verdictRes.ok) risk = await verdictRes.json(); } catch {} // unreachable or timed out: your handler still runs console.log('[maskbreak]', JSON.stringify({ decision: risk?.decision ?? null, reasons: risk?.reasons ?? null, risk_score: risk?.risk_score ?? null, linked_accounts: risk?.device?.linked_accounts ?? null, degraded: risk ? !!risk.degraded : null })); // Enforce later: if (risk?.decision === 'block') return res.status(403).json({ error: 'Request rejected' }); // and hold rewards or payouts once (risk?.device?.linked_accounts ?? 0) passes your own limit
A banned user, back on the same laptop
A plain browser on a home connection, fourth account on this device. Example response, selected fields:
{
"decision": "allow",
"risk_score": 0,
"reasons": ["multi_account_device"],
"network": { "vpn": false, "proxy": false, "datacenter": false,
"tor": false, "residential": true, "service": null },
"device": { "antidetect": false, "automation": false, "tampering_score": 0,
"visitor_id": "<visitor ID>", "returning": true,
"linked_accounts": 4, "multi_account": true }
}The decision is allow: multi_account_device is reported and left to your policy, so your code has to read the count. Refuse or hold the account once device.linked_accounts passes your limit, or match device.visitor_id against your ban list. If the same person comes back in a fake browser behind a residential proxy instead, the answer is block with proxy_detected and antidetect_browser, whether or not the device links: a fresh profile can look like a new device, which is what the fake-browser signal is for.
The signals that matter here
One device, many accounts. A new email and a new IP address change nothing about the device. Send your own accountId and Maskbreak links a keyed hash of it to a hash of the device's visitor ID, then returns device.linked_accounts, the number of your accounts seen on that device — the count that turns fifty "strangers" back into one operator. Do not confuse it with device.times_seen, which counts sightings of the device across all Maskbreak traffic, not your accounts. Links stay inside your account, are never shared across customers, and are removed after more than 90 days without activity.
Fake browsers often betray themselves. Kameleo, GoLogin, and AdsPower spoof canvas, WebGL, and fonts, and the spoofing is often measurable. Maskbreak reports it as device.antidetect with a tampering_score, beside automation, emulator, and virtual-machine checks, and antidetect_browser blocks by default. Detection varies with the tool and its version, so treat it as the second of two checks: linking catches a device that comes back, the fake-browser signal catches an antidetect browser used to look new.
Proxy rotation is a signal, not camouflage. Rotating residential proxies beat IP blocklists, but every live check returns the network context: vpn, proxy, datacenter, residential, tor, and the service name when known. A proxy blocks by default (proxy_detected); a VPN on its own is flagged for review (vpn_detected); a cloud-server address alone stays allow, with datacenter_asn listed. A device arriving from a new exit each session with yet another new account reads nothing like a regular on a home connection.
Verdicts you shape to your platform. Every response carries decision ('allow', 'review', 'block'), a 0–100 risk_score, and the reasons behind them. A marketplace might tolerate two accounts per household and hold payouts above that; a competitive game might refuse the third account from one device. Put those limits in your handler, reading device.linked_accounts. The Rules tab can act on multi-account too. That rule decides for the shared device only: a second account opened from a fake browser, through a proxy or Tor, by a bot or on an emulator still blocks. It matches every check that sends an accountId from a device linked to more than one of your accounts, logins included, and engine_decision keeps the engine's answer whenever a rule changes it. How rules combine.
Common questions
Start catching duplicate accounts
Free plan: 10,000 visitor checks a month, no card. Paid plans from €29 a month. Flags proxies, fake browsers and browser automation, and counts your accounts per device.