How to detect VMMask, the fingerprint browser
VMMask is a fingerprint browser, another name for an antidetect browser, built in China for running many e-commerce and social media accounts. Despite its name it is not a virtual machine: its site said "Creating a browser profile with VMMask is equivalent to creating a separate virtual browser environment" (archived homepage, April 2025). Maskbreak's answer does not name the product. It checks what every such session has to fake (the device, the network path and often the hands on the keyboard) and blocks a fake browser by default.
What VMMask is (October 2026)
Its site, in the name of Hainan Aike Technology Co., Ltd, promised to "Set different browser fingerprints for each account, just like using a different computer and broadband", with a "built-in login region matching mechanism" that matched each profile's time zone, language and coordinates to its proxy. It ran on Windows only, with team sub-accounts and departments, and an automation mode that "simulates manual operations": random pauses, typing mistakes that it deleted again, and simulated mouse movement (the same archived homepage). Its documentation offered two profiles free for life and three days' free use of a paid plan, and an API on request (archived docs).
It sold no proxies itself: "This product does not provide IP proxy service". Its proxy menu offered HTTP and SOCKS proxies beside "911 proxy", and its documentation sent users to 911.re, describing it as an independent provider of hundreds of thousands of dynamic residential addresses (archived docs, January 2022). KrebsOnSecurity described 911 as "a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily" (KrebsOnSecurity, July 2022), and in May 2024 the US Justice Department announced that the "911 S5" botnet behind it, linked to "more than 19 million unique IP addresses", had been dismantled (US Department of Justice).
Resecurity listed VMMask in July 2023 among "some of the most popular desktop editions of antidetect software" (Resecurity). Status: on 26 October 2026 vmmask.net reset the connection, its plain-HTTP address redirected to a Tencent Cloud page saying the site is temporarily inaccessible, and its last download link answered 404; the Internet Archive's last working copy of the homepage is from April 2025. We could not confirm that it is still sold.
How Maskbreak reads a VMMask session
A VMMask session makes three claims: a real device, an ordinary connection and a person at the keyboard. Maskbreak's device check and network intelligence test those claims separately. A fake browser, a script driving the browser or a proxy exit each blocks on its own by default; a VPN alone is flagged for review.
device.antidetect is true, the reason antidetect_browser is added and the decision is block, the same as for a proxy, Tor, automation or an emulator. It flags the class of tool; it does not say which product the visitor used.device.tampering_score is a 0–1 score from the device check, not a probability of fraud, and it can sit near zero while antidetect is true. Route on decision and reasons; do not build a threshold on the score.proxy_detected and blocks; a VPN alone adds vpn_detected and goes to review. A residential proxy it does not recognise passes this layer, which is why the device check matters.device.automation is true, the reason automation_detected is added and the visit is blocked. It does not name the framework; bot detection covers the signal in full.device.virtual_machine is true and the reason virtual_machine is listed; on its own it asks for review, never a block: plenty of developers browse from one. It raises the risk score next to other findings.device.times_seen counts how often the device appears in Maskbreak's retained history, across all customers, not only yours. Send your own accountId and device.linked_accounts counts how many of your accounts the device has been used for; more than one adds multi_account_device, and three or more of your accounts on one device within 24 hours add device_many_accounts and ask for review. Links stay inside your account, stored as keyed hashes. Profile switchers are built to defeat exactly this, so treat linking as an extra layer, not the main one.An example response: the fixture that GET /v1/evaluate/sample returns for ?scenario=bot (no key needed), a fake browser driven by a script on a clean-looking address, trimmed to the fields that matter. It is test data for your handler, not a measurement of VMMask.
// example response, POST /v1/evaluate
{
"decision": "block",
"risk_score": 83,
"reasons": ["antidetect_browser", "automation_detected"],
"network": {
"vpn": false,
"proxy": false,
"datacenter": false,
"tor": false,
"residential": true,
"service": null
},
"device": {
"antidetect": true,
"automation": true,
"virtual_machine": false,
"tampering_score": 0.78
}
}
Either finding alone would block. residential is true only because no proxy or cloud-server flag fired; it does not prove a home connection.
Shipping it
Add the Maskbreak browser snippet to your signup, login and checkout forms. Your server forwards the two tokens the snippet collects to POST /v1/evaluate with your API key and gets allow, review or block back, with the reasons; the device and network blocks carry everything above. Start in watch mode: log each decision and let every visitor through, then enforce once the Events log looks right. Field-by-field docs live in the API reference and the quickstart has the handler.
If some of your own customers run fake browsers for agency or seller work, set the Fake browser (antidetect) rule to review on the console's Rules tab. A rule changes the answer only for the signal it names, so a proxy or a script on the same visit still blocks; when a rule does change the answer, engine_decision keeps the default. The antidetect hub explains how the detection works and compares the other browsers; the multi-accounting playbook and Maskbreak for e-commerce cover the seller accounts VMMask was built for.
Free plan: 10,000 visitor checks a month, no card. Paid plans from €29 a month.