Maskbreak vs IPQS (IPQualityScore)

Weighing more than two tools? Our guide to IPQS alternatives covers the wider field, from IP data vendors to device fingerprinting.

IPQS scores what you send. Maskbreak checks the visit.

IPQS starts from an identifier you already hold. Send its Proxy & VPN Detection API an IP address, optionally with the visitor’s user agent, language and a strictness level from 0 to 3, and it returns a fraud_score from 0 to 100 with flags such as proxy, vpn, tor, recent_abuse and bot_status. Its docs call 75 and above “suspicious, but not necessarily fraudulent” and recommend flagging or blocking at 90. The same account validates email addresses, phone numbers and URLs. A JavaScript tag and mobile SDKs add device fingerprinting, which the plans page lists on Enterprise.

Maskbreak starts from the visit instead. On your page, Maskbreak’s snippet reads the connection and the browser as the form is sent; your backend passes both tokens and its key to POST /v1/evaluate. The reply is a single verdict: a decision (allow, review or block), a risk_score, the reasons, a network block and, once the browser check has finished, a device block. A visitor on a VPN with nothing odd about the browser gets a response like this (example response, selected fields):

{
  "decision": "review",
  "risk_score": 35,
  "reasons": ["vpn_detected"],
  "network": {
    "vpn": true,
    "proxy": false,
    "datacenter": false,
    "tor": false,
    "residential": true,
    "service": "<VPN service, when known>"
  }
}

Two details in there matter. First, service names the VPN or proxy operator when Maskbreak’s network intelligence knows it. IPQS markets detection of VPNs “from major providers like NordVPN, ProtonVPN, ExpressVPN”, but its documented proxy-API response has no field that names the operator. Second, a VPN on its own is review, not block, because plenty of honest people use one. The default policy blocks a proxy, a Tor exit, automation, an emulator or a tampered browser, and lets a cloud-server address through on its own, as allow with datacenter_asn still in the reasons. You can change the action for most signals (VPN, proxy, Tor, cloud server, fake browser, automation and more) on the console’s Rules tab. A rule changes the decision only for the signal it names, so relaxing VPN never lets a proxy or a tampered browser through. The integration guide starts in watch mode: it logs every decision, lets every visitor through, and blocks nothing until you switch it to enforce.

IPQS API response vs Maskbreak response

Field names say more than a feature grid. Here is the documented IPQS proxy-API response (IPQS counts “over 25 data points” per lookup) set against Maskbreak’s /v1/evaluate response, one question at a time.

Two footnotes. IPQS documents seven of its proxy-API fields as Enterprise only, among them frequent_abuser, shared_connection, security_scanner and abuse_events. On the Maskbreak side the device block appears only when the browser check completes; when it is missing, treat that as missing evidence, never as a clean result.

When a clean IP carries a fake browser

An IP score answers a question about the address: what has it done before, and what kind of network is it on? That works when the attacker’s address has a past. Rotating residential proxies make that past hard to find. They route traffic through ordinary home and mobile connections and hand out a fresh exit per session, sometimes per request, so the address at your signup form may have no record anywhere yet. IPQS fights this with data. It says it tracks “over 50 million live botnets and newly updated residential proxy IPs”, and it sells residential proxy detection on its SMB+ and Enterprise plans.

A live visit brings a second witness: the browser. To run twenty accounts from one laptop, a fraudster opens a fake browser, an antidetect browser such as Multilogin or GoLogin that invents a new device for every profile. The address can be spotless while the browser lies about itself, and that lie is what a browser check looks for. Here is that visit as Maskbreak would answer it: a home connection nothing has flagged, and a tampered browser (example response, selected fields).

{
  "decision": "block",
  "risk_score": 42,
  "reasons": ["antidetect_browser"],
  "network": {
    "vpn": false,
    "proxy": false,
    "datacenter": false,
    "tor": false,
    "residential": true,
    "service": null
  },
  "device": {
    "antidetect": true,
    "automation": false,
    "emulator": false,
    "tampering_score": 0.7
  }
}

The decision is block although risk_score is only 42: under the default policy, browser tampering blocks at any score. So route on decision. A 75-or-90 cut-off carried over from an IPQS integration would let this visit through; our post on risk score thresholds shows why.

IPQS can see this kind of visit too, on the right plan. Its device fingerprinting names antidetect tools (Multi-Login, Linken Sphere, FraudFox and AntiDetect) and claims to detect spoofing, emulators and GPS spoofing, and the device API returns a device_id, canvas and WebGL hashes and a high_risk_device flag. The plans page lists it on Enterprise only. On Maskbreak the browser check is on every plan, the Free plan included.

IPQS pricing in September 2026

IPQS publishes more of its pricing than most fraud vendors. The plans page lists five tiers, billed monthly with no contract, and marks every paid price “as low as”. As read on 24 September 2026:

What the table means in practice:

• Email validation, phone validation, URL scanning and IP reputation are on every plan, Free included, so Free is a real way to try IPQS.
• Residential proxy detection starts at SMB+ (as low as $999 a month). Device fingerprinting, the check that looks at the browser, is Enterprise only.
• The price per lookup does not fall in a straight line. By our division, Startup works out at about 2 cents a lookup, SMB Basic about 5 cents and SMB+ about 1.3 cents. SMB Basic adds transaction scoring, extra scoring settings and a rate of 20 lookups a second rather than a lower unit price.
• The daily caps on Free (35) and Startup (250) are what a bot wave hits first, and we found no overage price to quote. Ask IPQS what your integration gets back once a cap is reached before you put either plan in front of a live form.

The two allowances do not buy the same thing. IPQS’s free plan includes email and phone validation, which Maskbreak does not offer. Maskbreak’s Free plan includes the browser check, which IPQS lists on Enterprise only.

Maskbreak vs IPQS, feature by feature

What is IPQualityScore (IPQS)?

IPQS, short for IPQualityScore, has been running since 2011 and is headquartered in Las Vegas, Nevada. It is privately held, and LinkedIn lists it at 51–200 employees. Its homepage claims more than 3,500 business customers and “100m+ daily transactions”. The name undersells the catalogue: besides proxy, VPN and Tor detection, IPQS sells email and phone validation, device fingerprinting, bot detection, malicious URL and file scanning, transaction scoring and a Dark Web Leak API that checks emails, usernames and passwords against breach data. Its newsroom carried three items in July 2026: a Chrome plugin for investigating URLs, domains and IP addresses (8 July), then a partnership with Alloy and the overall sponsorship of MRC, the Merchant Risk Council, in 2027 (both 31 July).

What reviewers say. The two big review sites disagree. Reviewers on Capterra give IPQS 4.9 out of 5 (19 reviews); on Trustpilot it sits at 2.5 (58 reviews), mostly from people who say they or their sites were wrongly flagged. Our IPQS alternatives guide goes through both. Those Trustpilot complaints are also the case for watch mode with any new check: a week of logged decisions shows you who would have been turned away before anyone is.

IPQS or Maskbreak: which should you choose?

Or use both. They overlap less than the category name suggests. A signup handler can ask both at once: Maskbreak about the visit, IPQS about the email address and phone number entered on the form. Stop on a Maskbreak block. Hold the account for review on a Maskbreak review, or when IPQS reports a disposable address or a VOIP or prepaid number. Maskbreak’s only email signal is a disposable-domain check, so it will not replace IPQS email validation; on IPQS, the browser check (device fingerprinting) is Enterprise only.

IPQualityScore competitors and alternatives

The tools that turn up next to IPQS sort by the input they take. If all you have is an IP address, compare other IP data vendors: MaxMind (minFraud and its anonymous-IP data), IPinfo, IP2Location with its IP2Proxy data, proxycheck.io, GetIPIntel, vpnapi.io, AbuseIPDB and Scamalytics. If you are scoring a person across email, phone and device, look at SEON. If identifying the device is the main job, look at Fingerprint. A verdict on the live visit is Maskbreak’s lane. Whichever you shortlist, ask each vendor the two questions this page asked of IPQS: which fields come back, and which plan includes them. Our IPQS alternatives guide takes them one at a time.

Check your own connection first

The live check on our homepage runs your current visit through the same pipeline the API uses, with no signup. Turn on a VPN or a proxy first and see what it says. To see what an address alone can tell you, try the free IP lookup: it reports Tor exits and cloud-server ranges, and VPN and proxy verdicts still need a live visit. Proxy detection API vs IP lookup explains the difference.