Multilogin, AdsPower, GoLogin and a dozen smaller clones all sell the same product: a browser that lies convincingly about what device it runs on. For a few dollars a month you get hundreds of "profiles", each with its own fingerprint, cookies, proxy and history, each pretending to be a different person on a different machine. If your anti-bot strategy boils down to reading the fingerprint and trusting it, these tools were built to beat exactly you.
We've spent a lot of time reverse engineering how they work, partly because they show up constantly in the abusive traffic our customers ask us about. Here's what's inside, where the disguise cracks, and why we ended up scoring behavior instead of devices.
What an anti-detect browser actually is
Start with the Chromium source tree, patch it, rebuild. The patches override every value a fingerprinting script can read: User-Agent, screen geometry, hardwareConcurrency, deviceMemory, timezone, Accept-Language, the font list, the WebGL renderer string, canvas rasterization, AudioContext output. Each profile stores cookies and localStorage in its own container, binds to its own proxy, and replays the same set of lies on every visit, so it looks like a returning user rather than a fresh install.
The canvas trick is representative. A normal fingerprint script does this:
const c = document.createElement("canvas");
const ctx = c.getContext("2d")!;
ctx.font = "16px Arial";
ctx.fillText("phylaxa 🦊", 4, 20);
const fp = c.toDataURL(); // stable per GPU + driver + font stack
Anti-detect browsers intercept that path, often in C++ rather than JavaScript so page-level hooks can't see it, and add per-pixel noise seeded from the profile ID. The output is deterministic for the profile but matches no hardware that exists. WebGL gets the same treatment: UNMASKED_RENDERER_WEBGL reports whatever the profile config says — an RTX 3060 today, an Apple M4 tomorrow.
This is a mature product category. The better vendors pass the commodity fingerprint tests on public detection demo sites, because passing those tests is their marketing material.
The business model is multi-accounting
Nobody buys 500 browser profiles to protect their privacy. The paying use cases:
- Promo and referral abuse. Every new-user bonus, coupon and free trial gets redeemed by a fresh "device". At scale, this is the single biggest driver we see.
- Ad fraud. Click farms where each clicker presents as a distinct user on a distinct machine, burning ad spend that will never convert.
- Account farming. Bulk-registered accounts, aged with scripted activity, then sold by the thousand on marketplaces.
- Review and ranking manipulation, sneaker drops, ticket scalping. Anything where "one per customer" is the rule being broken.
The pricing tells you the economics: profiles cost cents each at volume, and subscriptions start around the price of a team lunch. The model only works if each profile survives your checks, so these vendors treat public fingerprint detectors as their QA suite. Sit with that for a second: when your detection is a fingerprint check, your adversary's test coverage is better than yours.
Spoofed fingerprints leak
Changing one signal is easy. Keeping hundreds of signals mutually consistent is where profiles fall apart. Three failure classes we rely on:
Noise has a statistical shape. Real canvas output is a deterministic function of GPU, driver and font stack. Injected noise is a deterministic function of a random seed. Render the same probe twice with slight variations and injected noise diverges in ways genuine rasterization never does. Worse for them: several tools re-seed on every launch, so the "same device" returns a different canvas hash after each restart. Real devices don't do that.
Claims contradict each other. The WebGL string says Apple M4 but the rasterization artifacts match SwiftShader on a VPS. The timezone says Berlin, but Intl.DateTimeFormat().resolvedOptions() disagrees with the Accept-Language header the proxy exits with. hardwareConcurrency says 16 while a timing benchmark reports one oversubscribed vCPU. Every field is individually plausible; the combination is impossible.
The patches are visible. Overriding a native getter changes what Function.prototype.toString returns:
const desc = Object.getOwnPropertyDescriptor(Navigator.prototype, "webdriver")!;
/\[native code\]/.test(String(desc.get)); // false when something patched it
Vendors counter-patch the detectors, and detectors counter-patch again. It's an arms race, and honestly it's overrated as a long-term strategy. We keep these checks because they're cheap, but the first two failure classes don't depend on winning it.
Behavior is the expensive thing to fake
A fingerprint is a claim. Behavior is evidence, and evidence has to stay consistent over time.
The operator behind profile #4127 is one person, usually running dozens of profiles from a single workstation. The physical mouse lives in one window at a time. Keystroke dynamics repeat across accounts that supposedly belong to different people. Work hours, tab-switch cadence, form-fill speed: all calibrated by the same pair of hands, all day long. Faking a canvas hash costs one config line. Faking two hundred sessions of coherent human input dynamics across fifty profiles is a research project.
That's why we score sessions, not devices. Phylaxa collects 300+ passive signals per session (TLS and HTTP/2 fingerprints, runtime probes, navigation structure, input dynamics) and a fine-tuned LLM scores whether the session behaves like a human who actually owns the device it claims to be. Fingerprint consistency is one input among many, never the verdict. Scoring runs at the edge in under 5 ms, so there's no challenge page and zero friction for real users — the same approach we described for LLM scraper detection.
What to do with this
Don't delete your fingerprint checks. They still filter out lazy automation, and they raise the attacker's cost. But treat every device claim as untrusted input, and put the decision weight on signals that are expensive to fake at scale: cross-session behavior, input dynamics, and the agreement between what a device says and what it does. If you're weighing what the abuse actually costs you, our piece on the real cost of bot traffic does the math.
Phylaxa is free for a limited time for products under 100,000 monthly active users. Details on the pricing page.