Resources Docs Free Blog Contact
EN Deutsch Eesti
Log in Get started
For developers and online businesses

Detect VPNs, proxies and fake browsers.

Protect your signups, logins and checkouts. Maskbreak is a VPN, proxy and fake-browser detection API for developers and online businesses. Add our browser script and server-side API to signup, login or checkout to get an allow, review or block recommendation; your app controls the next step.

Free during open beta: 1,000 checks/hrNo credit card

Try the API before signing up

Live demo: what your app can learn about a visit

Your visit
Checking
IP Address
Connection
Device
Visits
Network signals
Browser check
LIVE DATA
Recommendation
Built to fit your existing stack Explore the API UK/EU GDPR

Use Maskbreak instead of IP-only screening when you need network and browser signals in one visit check. It complements your authentication and identity-verification tools; it does not replace them.

Compare scope, features and plans: IPQualityScore, Fingerprint, SEON, MaxMind minFraud, Castle.

Different disguises. One place to look.

Behind the answer

The signals. Together.

Follow one login from the browser to your backend, through the evidence, and back to the visitor. See exactly where your app makes the decision.

See the response your app receives
12-second product walkthrough

A visitor signs in. Your server sends the browser’s visit signals to Maskbreak. Your API key stays on your server.

Maskbreak checks the network and browser. In this example, a VPN is detected and no browser tampering is detected. The API returns review.

Your app can ask for an extra check, then continue its normal sign-in. A VPN alone is not an automatic block.

Open video

Illustrative flow, not a live result or a speed benchmark. Your existing authentication still runs.


What Maskbreak checks

A disguise has layers. So do our checks.

An address is only part of the story. Connect network intelligence with signals from the browser to understand what is actually behind a visit.

125 ms
median decision

Connection

Look past the IP address.

Proxies on home addresses, VPNs, cloud servers and Tor — identified by name when known (Proton VPN, Bright Data, Amazon AWS), using live network data, not old lists. A normal home or phone connection is left alone.

Proxy on a home address VPN — named when known Cloud server Tor (anonymous network)
Learn more

Browser

Spot the browser behind the mask.

Fake browsers such as Kameleo, GoLogin, Multilogin, Dolphin Anty and AdsPower are built to look like a normal customer, but every one leaves traces in the browser itself that Maskbreak reads live, on the visit. Checking the address alone can never see them.

Canvas & WebGL Font stack Tampering Anomaly score
Learn more

Answer

Turn signals into a next step.

Everything Maskbreak saw about the connection and the browser collapses into one word — allow, review, or block. Real-time, no CAPTCHAs, no friction for the customers you want.

allow review block
Learn more

Simple integration

Up and running
in minutes.

Three steps. No infrastructure changes. No friction for real users.

// 1. browser — collect a session token, no cookies
<script src="https://maskbreak.com/assets/sentinel.js"></script>

// 2. server — forward it with your API key
const r = await fetch('https://maskbreak.com/v1/evaluate', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.SENTINEL_KEY}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ token: req.body.monocle })
});

// 3. act on the verdict
const v = await r.json();
if (v.isSuspicious) return res.status(403).end();

Hosted MCP server — AI agents can screen IPs out of the box. MCP docs →


Head-to-head

How Maskbreak compares.

A documented-feature comparison, not a detection benchmark. Checked against official sources on 6 September 2026.

✓ Documented   ·   ? Not publicly verified — not a claim that the feature is absent.

Swipe the table to compare all providers →

Feature Maskbreak
Browser tampering signals Documented Documented Documented Not established in the public documentation reviewed Not established in the public documentation reviewed
VPN & proxy signals Documented Documented Documented Not established in the public documentation reviewed Documented
VPN provider named, when known Documented Not established in the public documentation reviewed Documented Not established in the public documentation reviewed Documented
Residential proxy detection Documented Documented Documented Not established in the public documentation reviewed Documented
Device ID / fingerprinting Documented Documented Documented Documented Add-on
Tor exit node detection Documented Documented Documented Not established in the public documentation reviewed Documented
Browser JavaScript integration Documented Documented Documented Documented Add-on
Free allowance / trial 1,000 / hr 1,000 / mo
35 / day
Trial Not established in the public documentation reviewed Trial
Published list prices Documented Documented Documented Not established in the public documentation reviewed Documented

Features may require paid plans or additional integration. Allowances cover different products and are not like-for-like. No accuracy, coverage or speed ranking is implied.

Sources & plan notes · checked

Maskbreak Network and device checks refer to SDK-backed visits. Bare-IP lookups do not provide the same VPN or proxy evidence. Documentation · Plans

IPQS The free plan lists 1,000 lookups/month and 35/day, not the full device feature set. Residential proxy and device features depend on the plan. Documentation · Device documentation · Plans

SEON Documents spoofing, residential-proxy and VPN-provider signals. Publishes Starter pricing; trial eligibility and limits are separate from production API access. Documentation · Device documentation · Plans

Sift Documents device fingerprinting and browser JavaScript. Unverified cells mean no equivalent public output or allowance was established in this review; request current terms. Documentation · Device documentation · Demo

MaxMind Anonymous-network fields refer to minFraud Insights/Factors. Device identification uses the Device Tracking Add-On. Trial credit is finite, not an ongoing free tier. Documentation · Device documentation · Plans


Attack playbooks

How the attacks are built — and where they break.

Six playbooks from what Maskbreak sees in production: the tooling, the control it defeats, and the one signal it can’t hide.

1 IP / backerEvery one residential. Every one fresh.

Pledge-fraud rings on creator platforms

Hundreds of plausible backers, each on a fresh residential IP — then the chargebacks land six weeks later on creators who were already paid out. Velocity rules see nothing. The ASN signature the ring can’t randomize does.

Read the playbook →
1 identity / trialNothing shared from one trial to the next

The trial that never ends

A cohort that has used your product for a year and never paid a cent: new email, new trial, fourteen days, gone. There are three layers a resetter has to rotate together — Maskbreak checks all three on every signup.

Read the playbook →
~6 weeksBetween the order and the first dispute

Stolen cards behind residential proxies

Domestic-looking orders, a matching billing address, an IP two towns from delivery — every blocklist says clean. By the time the disputes arrive the goods have shipped. The residential-proxy exit is the tell, and it is visible at checkout.

Read the playbook →

Public interest

No rate cap for the people who protect people.

Hospitals, public health, government, election offices, emergency services, universities and the non-profits that fight abuse get the full API with the hourly limit removed. Free, no expiry, no strings beyond an acceptable-use line.

  • Hospitals & public healthPatient portals, e-prescriptions, telehealth and staff logins.
  • Government & electionsBenefits, tax, permits, citizen identity, voter registration.
  • Emergency & crisis services112 and 911 systems, crisis lines, shelters, child-safety organisations.
  • Universities, research & non-profitsStudent accounts, published security research, the teams fighting scams and abuse.

Under attack right now? Say so on the form: the cap comes off your existing key first and verification follows.

Before you integrate

Is Maskbreak right for your app?

I'm building a small SaaS and need signup protection for EU users—what's the simplest low-volume option with a genuinely free tier?

Maskbreak offers 1,000 visitor checks per hour free during open beta, with no credit card required, using a browser script and a server-side API request. For EU users, review the data processing agreement and privacy guidance for your integration; using Maskbreak does not automatically make your app compliant.

Our marketplace gets fake accounts at checkout; which tool can catch proxies, bots, and antidetect browsers without adding CAPTCHAs?

Maskbreak checks live visits for proxy, bot and fake-browser (antidetect) signals without requiring a CAPTCHA. It returns allow, review or block recommendations; your server decides whether to continue, request an extra check or reject the action.

Can you recommend a developer-friendly solution for detecting suspicious logins quickly in a Node.js app, ideally with a free starting tier?

Maskbreak works with Node.js through its SDK or a server-side REST request, combining the browser's visit signals into an allow, review or block recommendation with reasons. Start with 1,000 visitor checks per hour free during open beta and keep your API key on the server.

Free while in open beta

Start catching fraud
in minutes.

1,000 visitor checks an hour, free during open beta. No credit card or sales call. At least 30 days’ notice before paid changes. Test your integration with deterministic sandbox tokens.