VPN & Proxy Detection — BrazilDetect VPN, Proxy & Bot Traffic from Brazil
Maskbreak scores every visitor's network in real time — flagging VPN exit nodes, residential proxies, datacenter ASNs, and headless browsers originating from Brazil. Free API. Under 40ms server-side. No CAPTCHAs.
The networks Brazil traffic actually arrives from
Brazil has 8,763 autonomous systems on the public registry. 179 of them are hosting, cloud or transit networks holding 60.2M addresses between them — the ranges a commercial VPN or datacenter proxy exits from. Residential broadband is the rest, and that is the traffic worth watching, because a residential proxy hides inside it.
| ASN | Network | IPv4 space |
|---|---|---|
| AS26599 | TELEFONICA BRASIL S.A | 10.8M addresses |
| AS28573 | Claro NXT Telecomunicacoes Ltda | 10M addresses |
| AS26615 | TIM SA | 9.8M addresses |
| AS4230 | CLARO S.A. | 5.2M addresses |
| AS27699 | TELEFONICA BRASIL S.A | 4.6M addresses |
| AS18881 | TELEFONICA BRASIL S.A | 4.6M addresses |
| AS8167 | V tal | 2.5M addresses |
| AS10429 | TELEFONICA BRASIL S.A | 1.7M addresses |
Largest hosting-shaped networks registered in Brazil, by IPv4 allocation. Registry data, refreshed daily. A datacenter ASN is not evidence of fraud on its own — it is one signal, weighed alongside device and behaviour.
Why Brazil traffic needs special scrutiny
Datacenter ASN concentration
Brazil is one of the world's largest residential proxy markets, primarily Vivo and Claro consumer ranges.
Residential proxy resale
Consumer ISP ranges in Brazil can appear in commercial or peer-to-peer residential proxy pools. A consumer ISP label is not proof of fraud; combine it with device, session, and routing signals.
VPN exit-node clustering
The same handful of hosting providers dominate VPN exit nodes in Brazil. Maskbreak maintains live mappings of these ranges so a new IP from a known VPN ASN is flagged within seconds of going live.
Antidetect browser usage
Multi-accounting fraud against Brazilian-targeted SaaS, fintech, and e-commerce increasingly uses Kameleo, GoLogin, or AdsPower to spoof device fingerprints. Maskbreak scores these at the device layer, not the IP layer.
What Maskbreak detects for Brazil traffic
- Every major VPN provider's Brazilian exit nodes (NordVPN, ExpressVPN, ProtonVPN, Mullvad, Surfshark, and 40+ more)
- Commercial or peer-to-peer residential proxy pools using consumer Brazilian IPs
- Datacenter ASNs commonly used for automation (AWS, GCP, Azure, OVH, Hetzner, DigitalOcean, Vultr, Linode)
- Tor exit nodes and known anonymous relays advertising Brazilian geolocations
- Headless browsers (Puppeteer, Playwright, Selenium) and antidetect tooling driving sessions from Brazil
- Country-spoofing — when a session claims to be in Brazil but the network telemetry says otherwise
VPN use & data rules in Brazil
Brazil regulates personal data under the LGPD (Lei Geral de Proteção de Dados), enforced by the ANPD since 2020. Like the GDPR it was modeled on, the LGPD explicitly recognizes fraud prevention as a lawful basis for processing — you can run network and device risk checks on Brazilian visitors without consent friction, provided the processing is proportionate. The fraud context matters: since Pix made instant payments universal, account takeover and mule-account schemes have surged, and Brazil's consumer ISP ranges (Vivo, Claro, Oi) are heavily resold into residential proxy pools. Practical takeaway: a Brazilian residential IP tells you very little on its own — corroborate with device-layer signals before trusting or blocking a session.
One API call. Bearer token. Done.
// Server-side only: an sk_live_ key must never reach the browser.
const r = await fetch('https://maskbreak.com/v1/evaluate', {
method: 'POST',
headers: {
'Authorization': 'Bearer sk_live_...',
'Content-Type': 'application/json'
},
body: JSON.stringify({ token: req.body.monocle })
});
const { decision, country, network } = await r.json();
if (country === 'BR' && network.vpn) blockOrChallenge();
Stop Brazilian VPN, proxy & bot fraud today
Free tier: 1,000 requests/hour. No card, no expiry. Detects VPN, residential proxy, datacenter, and bot traffic from Brazil and 195 other countries.