Maskbreak vs MaxMind minFraud

minFraud scores the transaction. Maskbreak checks the visit.

Every minFraud call describes an event in your business. The request names the event type (account_creation, account_login, password_reset, payout_change, purchase and seven more) and carries whatever you know at that moment: the IP address and user agent, the email, the card, billing and shipping addresses, the phone, the order and up to 100 custom inputs of your own. minFraud answers with a risk_score from 0.01 to 99, which MaxMind defines as a probability: “a score of 20 indicates a 20% chance that a transaction is fraudulent”. Your custom rules turn that into accept, reject or manual review.

A Maskbreak call describes a visit. The script on your page collects two tokens from the browser, and your server sends them to POST /v1/evaluate with your API key. The answer is a decision (allow, review or block), a 0–100 risk_score and reasons such as vpn_detected, proxy_detected, automation_detected or antidetect_browser. It needs no card, address or order, so it works on a signup form before you know anything about the person. For the same reason it cannot judge a payment.

So the choice follows your data. At checkout you hold the card, the addresses and, weeks later, chargebacks to report back: that is minFraud’s ground. At signup and login you mostly hold a browser and an email address. minFraud scores those events too, from the IP, the email and, if you run its Device Tracking Add-On, a device ID. What its documentation does not describe is detection of fake browsers or automation, and that is the part Maskbreak was built for.

Maskbreak vs MaxMind minFraud, side by side

MaxMind minFraud pricing (September 2026)

MaxMind publishes per-query prices, so you can budget before talking to anyone. As of 24 September 2026 the minFraud pricing page lists three tiers, each billed per query from prepaid credit. The per-10,000 column is our arithmetic at list price, before any volume discount.

How you pay. Credit is bought up front, in preset amounts of $25, $50, $100 or $250 or any whole-dollar amount from $20 to $25,000, and the same balance also pays for MaxMind’s GeoIP web services. The page promises “No Commitment” and “No Minimums”; volume discounts go through MaxMind’s sales team. All three tiers take the same request, and you change tier by calling a different endpoint URL, so starting on Score and moving up later costs no rework.

What it adds up to. Every scored event is one query. A shop that screens 20,000 orders a month on Insights pays $300 at list price. Score its signups and logins as well, say another 60,000 events, and the monthly bill becomes $1,200. Pick the tier with care: the VPN and proxy flags, the provider’s name and the email and address checks come back on Insights and Factors, not on the $0.005 Score tier.

Trying it. MaxMind offers a free trial of up to 1,000 queries on request. There is no ongoing free tier, and the sandbox is for integration tests only: it needs a paid account, and its data “is not accurate and should not be used to evaluate the efficacy of the minFraud scoring engine”. The free MaxMind data people often have in mind is GeoLite (country, city and ASN, 1,000 web-service lookups a day per service), which has no minFraud scoring and no proxy data. We found no separate published price for the Device Tracking Add-On.

Maskbreak’s prices are on /pricing. Visitor checks count against a calendar-month allowance; bare IP lookups have their own, ten times the plan’s checks (100,000 a month on Free), and GET /v1/usage shows your usage. If you run an approved public-interest organisation, the cap comes off.

What is MaxMind minFraud?

minFraud is MaxMind’s fraud-scoring web service: you send a transaction or account event (IP, email, card, addresses, device) and get back a risk score from 0.01 to 99, in three tiers: Score, Insights and Factors. MaxMind, Inc. was founded in 2002 by Thomas “TJ” Mather and is privately held, based in Malden, Massachusetts (Wikipedia). It is the company behind the GeoIP geolocation data and says 100,000+ businesses rely on its data. minFraud followed in 2004. Two naming notes, because they trip up searches. MaxMind now says GeoIP and GeoLite where it used to say GeoIP2 and GeoLite2; the old names survive in library and package names. And “minFraud Legacy” is a separate, older web service, not the Score, Insights and Factors API compared on this page.

The current API is far from frozen. This is what the release notes record since the start of 2025:

Running Maskbreak and minFraud together

Because they read different evidence, the two do not fight over the same slot in your stack. A split that plays to each:

At signup. A multi-accounting farm opens its tenth account of the day. Each account gets its own profile in a fake browser such as Multilogin or AdsPower, and each profile its own residential proxy, so the address looks like a home broadband line and the browser looks brand new. There is no card yet, so minFraud would have the IP, the email and, if you run its Device Tracking Add-On, a device ID to work with, and Insights documents residential-proxy flags for addresses MaxMind’s probing has seen. Detecting the fake browser is the part its documentation does not cover. This is what the signup submit can return from Maskbreak.

Example response, selected fields: a fake browser behind a residential proxy.

{
  "decision": "block",
  "risk_score": 93,
  "reasons": ["proxy_detected", "antidetect_browser"],
  "network": {
    "vpn": false,
    "proxy": true,
    "datacenter": false,
    "tor": false,
    "service": "<proxy service, when known>"
  },
  "device": {
    "antidetect": true,
    "automation": false,
    "emulator": false,
    "tampering_score": 0.8
  }
}

The block comes from the proxy and the fake browser together, and under the default policy either one alone would have been enough, so the signup stops there and the account never reaches a checkout. Tor, automation and emulator signals block by default too. A VPN is treated more gently: with nothing else wrong, a VPN visitor is flagged for review, not blocked, since many honest users run one, so you might ask for an email confirmation instead of refusing. If your product sees it differently, set the action for most signals yourself on the console’s Rules tab. A rule changes the decision only for the signal it names, so setting VPN to allow still blocks a VPN visitor in a fake browser. When a rule does change the answer, the response keeps the engine’s own answer in engine_decision. Pass an accountId as well and the answer tells you when this browser already sits behind other accounts, counted inside your own account only, never across customers.

At checkout. Call Maskbreak before minFraud. A card-testing script submits your payment form over and over, usually from a headless browser or through a proxy pool, and every attempt your handler refuses on Maskbreak’s block is a minFraud query you do not pay for. The orders that pass go to minFraud with the transaction data. minFraud’s request takes up to 100 custom inputs, so Maskbreak’s decision and reasons can travel with the order.

Roll it out quietly first. In watch mode your code logs Maskbreak’s decision and carries on regardless; once the Events log matches what you expected, switch to enforce (the rollout guide walks through it). Keep minFraud for what Maskbreak leaves out: order scoring, card and address checks and the chargeback feedback loop. Maskbreak also has no cross-customer identity network, no manual review team and no KYC.

When to use minFraud, when to use Maskbreak

minFraud alternatives and competitors

People comparing minFraud usually want to replace one of two things, and the two lead to different shortlists.

Check it on your own connection

The live check on our homepage runs your own visit through the same pipeline as the API, with no signup. Switch a VPN on first and see what comes back. For a single address there is the free IP lookup, which covers Tor exits and published cloud ranges only; VPN and proxy verdicts, with the service named when known, need a live visit like the homepage check.