How to detect MaskFog and its proxies in 2026
MaskFog is an antidetect browser: a fake browser that gives each profile its own fingerprint, sold together with its own proxies so that every account gets a separate address. It calls itself an "Anti-detect browser for effective multi-account management." (maskfog.com). Maskbreak's answer does not name the product. It checks what every such session has to fake (the device, the network path and often the hands on the keyboard) and blocks a fake browser by default.
What MaskFog is (October 2026)
Its help centre says each profile gets its own fingerprint, including the time zone, default language, user agent, fonts and screen resolution (help centre), and that when a dynamic IP address changes, the time zone and location are matched to it in real time (help article). Its site does not name the browser engine; it installs Chrome Web Store extensions (extensions), which points to Chromium. The Windows and macOS builds were at version 1.8.20 on 26 October 2026 (downloads), and its homepage offers Selenium support and team permissions with detailed action logs.
The proxies are what the searches for "maskfog proxy" are about. MaskFog calls its proxies "devices" and sells them itself: "The proxy sold in this product is a static proxy", and "Purchased proxy can be used only in MaskFog", (pricing), although one of its help articles explains adding them to AdsPower (help article). Dedicated proxies start at $4.99 for 30 days and shared ones at $0.15 a day (FAQ), and its help centre calls residential ones less likely to be detected as proxies (help article).
Plans: Free has 20 browser environments; Base, at $2 a set, and Pro, from $4.99, have no limit, and automation comes only with Pro, by custom arrangement. Every new user gets three days free. Its contact page names Tiger Roar Technology PTE LTD of Singapore, while its footer names Redius Communications Limited beside a Chinese licence number (contact). Its terms say: "We don’t oversee what users are using the Services for." (terms of use).
How Maskbreak reads a MaskFog session
A MaskFog session makes three claims: a real device, an ordinary connection and a person at the keyboard. Its own proxies are there to make the second one stick. Maskbreak's device check and network intelligence test those claims separately. A fake browser, a script driving the browser or a proxy exit each blocks on its own by default; a VPN alone is flagged for review.
device.antidetect is true, the reason antidetect_browser is added and the decision is block, the same as for a proxy, Tor, automation or an emulator. It flags the class of tool; it does not say which product the visitor used.device.tampering_score is a 0–1 score from the device check, not a probability of fraud, and it can sit near zero while antidetect is true. Route on decision and reasons; do not build a threshold on the score.proxy_detected and blocks; a VPN alone adds vpn_detected and goes to review. A residential proxy it does not recognise passes this layer, which is why the device check matters.device.automation is true, the reason automation_detected is added and the visit is blocked. It does not name the framework; bot detection covers the signal in full.device.virtual_machine is true and the reason virtual_machine is listed; on its own it asks for review, never a block: plenty of developers browse from one. It raises the risk score next to other findings.device.times_seen counts how often the device appears in Maskbreak's retained history, across all customers, not only yours. Send your own accountId and device.linked_accounts counts how many of your accounts the device has been used for; more than one adds multi_account_device, and three or more of your accounts on one device within 24 hours add device_many_accounts and ask for review. Links stay inside your account, stored as keyed hashes. Profile switchers are built to defeat exactly this, so treat linking as an extra layer, not the main one.An example response: the fixture that GET /v1/evaluate/sample returns for ?scenario=bot (no key needed), a fake browser driven by a script on a clean-looking address, trimmed to the fields that matter. It is test data for your handler, not a measurement of MaskFog.
// example response, POST /v1/evaluate
{
"decision": "block",
"risk_score": 83,
"reasons": ["antidetect_browser", "automation_detected"],
"network": {
"vpn": false,
"proxy": false,
"datacenter": false,
"tor": false,
"residential": true,
"service": null
},
"device": {
"antidetect": true,
"automation": true,
"virtual_machine": false,
"tampering_score": 0.78
}
}
Either finding alone would block. residential is true only because no proxy or cloud-server flag fired; it does not prove a home connection.
Shipping it
Add the Maskbreak browser snippet to your signup, login and checkout forms. Your server forwards the two tokens the snippet collects to POST /v1/evaluate with your API key and gets allow, review or block back, with the reasons; the device and network blocks carry everything above. Start in watch mode: log each decision and let every visitor through, then enforce once the Events log looks right. Field-by-field docs live in the API reference and the quickstart has the handler.
If some of your own customers run fake browsers for agency or seller work, set the Fake browser (antidetect) rule to review on the console's Rules tab. A rule changes the answer only for the signal it names, so a proxy or a script on the same visit still blocks; when a rule does change the answer, engine_decision keeps the default. The antidetect hub explains how the detection works and compares the other browsers; the multi-accounting playbook and Maskbreak for e-commerce cover the store and social media accounts MaskFog is sold for.
Free plan: 10,000 visitor checks a month, no card. Paid plans from €29 a month.