FraudFox: the antidetect VM and how to detect it
FraudFox was an early antidetect tool: a Windows virtual machine that gave each profile a made-up browser fingerprint. KrebsOnSecurity called it "a crimeware tool called FraudFox, which is marketed as a way to help crooks sidestep browser fingerprinting" (KrebsOnSecurity, March 2015), and its own store said it was "used mainly for fraudulent credit card transactions online" (2016). Its site, fraudfox.net, no longer resolves. Maskbreak's answer does not name the product. It checks what every such session has to fake (the device, the network path and often the hands on the keyboard) and blocks a fake browser by default.
What FraudFox was (October 2026)
FraudFox ran as a virtual machine. Its archived homepage, the same in 2016 and 2021, described a "Windows 7 Enterprise based Virtual Machine (VM), which is compatible with VMWare Workstation, VMWare Fusion and VirtualBox", with "device details manipulation via the Virtual Machine (VM) console, changing the TCP/IP fingerprint using built-in utilities", and profiles saved as files with their own .ffox extension (archived homepage). Earlier versions differed: in January 2015 the IDG News Service described "a special version of Windows with a heavily modified version of the Firefox browser", for sale on the Evolution market "for 1.8 bitcoins, which is about $390" (PCWorld). The seller's store listed it at "USD 99 / Month" in 2016, beside the line quoted above (archived store, 2016), and by 2020 at $100 a month, $450 for six months or $1,200 for life, paid in cryptocurrency (archived store, 2020).
Researchers took it apart. In "Taming the Shape Shifter", presented at DIMVA 2020, Amin Azad, Starov, Laperdrix and Nikiforakis found that the version they tested used "a custom Windows XP virtual machine and a tool named OSfuscate to change the TCP/IP fingerprint", added noise to the canvas, blocked WebGL and sent its traffic through a proxy with SocksCap64. Its profiles also gave themselves away: "Chrome profiles present moz-prefixed properties but no webkit ones. Mac profiles show .dll extension for plugins instead of .plugin." (the paper).
It is gone. On 26 October 2026 fraudfox.net had no address record and did not load; the Internet Archive's last working copy of its homepage is from September 2021, and the store's domain had expired by April 2022 (archived store, 2022). Its central trick, a browser profile that claims to be a different device, lives on in the commercial fake browsers sold openly today, listed in our antidetect browser directory.
How Maskbreak reads a FraudFox session
A FraudFox session made three claims: a real device, an ordinary connection and a person at the keyboard. Maskbreak's device check and network intelligence test those claims separately. A fake browser, a script driving the browser or a proxy exit each blocks on its own by default; a VPN alone is flagged for review.
device.virtual_machine is true and the reason virtual_machine is listed; on its own it asks for review, never a block: plenty of developers browse from one. It raises the risk score next to other findings.device.antidetect is true, the reason antidetect_browser is added and the decision is block, the same as for a proxy, Tor, automation or an emulator. It flags the class of tool; it does not say which product the visitor used.device.tampering_score is a 0–1 score from the device check, not a probability of fraud, and it can sit near zero while antidetect is true. Route on decision and reasons; do not build a threshold on the score.proxy_detected and blocks; a VPN alone adds vpn_detected and goes to review. A residential proxy it does not recognise passes this layer, which is why the device check matters.device.automation is true, the reason automation_detected is added and the visit is blocked. It does not name the framework; bot detection covers the signal in full.device.times_seen counts how often the device appears in Maskbreak's retained history, across all customers, not only yours. Send your own accountId and device.linked_accounts counts how many of your accounts the device has been used for; more than one adds multi_account_device, and three or more of your accounts on one device within 24 hours add device_many_accounts and ask for review. Links stay inside your account, stored as keyed hashes. Profile switchers are built to defeat exactly this, so treat linking as an extra layer, not the main one.An example response: the fixture that GET /v1/evaluate/sample returns for ?scenario=bot (no key needed), a fake browser driven by a script on a clean-looking address, trimmed to the fields that matter. It is test data for your handler, not a measurement of FraudFox.
// example response, POST /v1/evaluate
{
"decision": "block",
"risk_score": 83,
"reasons": ["antidetect_browser", "automation_detected"],
"network": {
"vpn": false,
"proxy": false,
"datacenter": false,
"tor": false,
"residential": true,
"service": null
},
"device": {
"antidetect": true,
"automation": true,
"virtual_machine": false,
"tampering_score": 0.78
}
}
Either finding alone would block. residential is true only because no proxy or cloud-server flag fired; it does not prove a home connection.
Shipping it
Add the Maskbreak browser snippet to your signup, login and checkout forms. Your server forwards the two tokens the snippet collects to POST /v1/evaluate with your API key and gets allow, review or block back, with the reasons; the device and network blocks carry everything above. Start in watch mode: log each decision and let every visitor through, then enforce once the Events log looks right. Field-by-field docs live in the API reference and the quickstart has the handler.
If some of your own customers run fake browsers for agency or seller work, set the Fake browser (antidetect) rule to review on the console's Rules tab. A rule changes the answer only for the signal it names, so a proxy or a script on the same visit still blocks; when a rule does change the answer, engine_decision keeps the default. The antidetect hub explains how the detection works and compares the other browsers; the card testing and account takeover playbooks cover the jobs its sellers named.
Free plan: 10,000 visitor checks a month, no card. Paid plans from €29 a month.