Maskbreak checks every signup and login on your site and spots people hiding behind a VPN, a proxy, a bot or a fake browser. Real customers get in. The rest get one more step, or get stopped.
Free plan: 10,000 checks a monthPaid plans from €29 a monthNo credit cardNo sales call needed
Instant API key. Setup starts in watch mode: it blocks no one until you turn blocking on.
How it fits
{
"decision": "review",
"risk_score": 65,
"network": {
"vpn": true,
"service": "PROTON_VPN"
},
"reasons": [
"vpn_detected",
"datacenter_asn"
]
}One call to the fraud detection API checks each visit twice: the connection it comes from and the browser it runs in.
The hardest kind to spot: real home and phone connections rented out to fraudsters. We check the connection itself and name the proxy service when it is known.
Live test · 30 September 2026A real 4G mobile proxy on an Estonian carrier SIM was blocked on the first visit.Read the test
A visitor ID built to survive private windows and cleared cookies, so the same device coming back under a new account is no longer a stranger.
Multilogin, GoLogin, Kameleo and the like give one person hundreds of made-up identities. We read the browser itself, so a fake fingerprint, automation or a virtual machine shows through.
What your server getsBlock · risk 83 · antidetect_browser, automation_detectedSee the sample response
Email and phone checks: whether an address or a number is real, throwaway or reported for fraud. In every plan, in the dashboard and the API together: 3 checks a day on Free, 20 on Starter, 50 on Growth and 150 on Scale.
Your app gets one of three answers, with the reasons behind it. You decide what each one means on your site.
A visit with no detected warning signs
A person using a VPN
A browser showing signs of tampering
These are recommendations, not proof of who someone is. When a check can’t run, Maskbreak lets the visit in and marks the answer incomplete. Read the decision policy →
Yes: 10,000 visitor checks a month with no credit card, and paid plans from €29 a month. For EU users there is a data processing agreement, though using Maskbreak does not make your app compliant by itself.
Maskbreak checks each visit for proxies, bots and fake browsers without showing a CAPTCHA. Your site then lets the visitor in, asks for one more step or blocks them, as you choose.
Yes. Maskbreak works through its Node.js SDK or a plain request from your server, and the API key stays on your server.
Paid plans from €29 a month, VAT included. See pricing
Enterprise: volume beyond the plans, your own limits, and our data processing agreement.
For a security review: Data processing agreement · Security whitepaper · Sub-processors · Status and SLA