Exposing Antidetect Browsers: 11 Vendors × 300+ Signals

In brief: 11 antidetect browsers tested, 11 detected. Confidence 0.72–0.98. Prototype integrity, global pollution, and JA4 catch them all.

Promise Versus Reality

Antidetect browsers sell a simple dream: be anyone you want online. Swap your fingerprint, rotate your identity, vanish. Marketing copy gleams. Telegram channels overflow with success stories. Price tags range from $24/month to $300/month.

We bought all of them.

We tested eleven antidetect browsers: Multilogin, GoLogin, Dolphin Anty, Linken Sphere, Undetectable, AntiDetect, Fraudfox, AdsPower, Kameleo, Incogniton, and OctoBrowser. We created profiles across every supported OS and browser combination, routed traffic through residential proxies, and ran each profile through WHOX's full detection pipeline.

Every single one was detected. Detection confidence ranged from 0.72 to 0.98 depending on vendor and configuration. Not one browser, in any configuration, managed a clean pass.

A note on method: confidence scores represent the weighted probability that a session comes from a modified browser rather than a stock install. A score of 0.72 means the system is 72% confident it's looking at an antidetect tool. A score of 0.98 means near-certainty. Scores are drawn from the aggregate of signals across all three detection axes: fingerprint uniqueness, cross-signal consistency, and anonymization artifacts. Each vendor was tested across its full range of supported OS and browser profile combinations, with traffic routed through residential proxies to strip IP-based detection out of the equation.

What follows is the full technical teardown. How each one failed, why the failures are structural, and what the detection heatmap looks like across hundreds of signals.

Four-Tier Detection Hierarchy

Detection isn't a single trick. Layers stack, and each layer catches what the previous one misses. A four-tier hierarchy progressively narrows the classification, from we know exactly which tool you're using down to something is clearly wrong here.

Tier 1: Vendor Flavor. Most damning tier of all. Every antidetect browser leaves vendor-specific artifacts: unique fingerprints that identify not just that you're running an antidetect tool, but which tool and sometimes which version. Imagine leaving your driver's license at a crime scene. Multilogin's Mimic engine has its canvas delta pattern and HTTP/2 anomaly. GoLogin leaves five or more prototype chain anomalies. Dolphin Anty pollutes the global scope with identifiable keys. Linken Sphere sets proxy traps on the navigator object. We'll dig deep on each one below.

Tier 2: Signal Combination. Even if a vendor scrubs its specific artifacts, certain combinations of signals are physically impossible. A Windows User-Agent paired with an Apple GPU. An Android device with zero touch points. A Chrome User-Agent with a Firefox error stack format. Not just suspicious. Nonexistent in nature. A C14 impossible combinations matrix catches exactly these clashes.

Tier 3: Privacy vs. Antidetect. A genuine gap separates someone using Brave's built-in privacy features from someone running Multilogin with a spoofed profile. Privacy browsers reduce signals. Standardize, generalize, or block. Antidetect browsers add signals: they inject scripts, warp prototypes, and pollute the global scope. Noise they create to fake one identity actually births another. Distinguishing between a user who cares about privacy and a user who's pretending to be someone else varies wildly by browser, as documented in Full Audit: 8 Browsers × 157 Checks.

Tier 4: Generic Anomaly. Broadest net. When Tiers 1 through 3 don't yield a specific match, the session still gets flagged as anomalous. Too many small inconsistencies. Prototype chains that don't quite look right. Timing patterns suggesting emulation. Canvas integrity flags hinting at tampering. Confidence runs lower here, but the signal stays clear: someone's modified the browser.

Layering means that even as vendors fix their vendor-specific artifacts, three more detection strata await. Each one draws on fundamentally different signals.

Detection Heatmap: A Bird's-Eye View

Before diving into individual vendors, here's the heatmap across all eleven browsers tested.

Rows are vendors. Columns are check categories. Cells glow red for detected, yellow for partial signal, and green for clean pass. Pattern is striking.

Prototype integrity and global pollution light up red for every JS-injection tool. AntiDetect, Fraudfox, Dolphin Anty, AdsPower, Incogniton, and OctoBrowser. Six out of eleven caught by the same family of checks. Like they're all wearing the same brand of knockoff shoes.

Network-layer checks catch a different subset. JA4 TLS fingerprint, HTTP/2 SETTINGS frame, and TCP-level OS detection fire for tools that modify the browser but not the network stack. Multilogin Mimic, GoLogin, Kameleo, and partially Undetectable. All that effort poured into the JavaScript environment, while the browser speaks to the server before any JavaScript runs.

Canvas and WebGL consistency catches the overlap: tools that modify rendering output but can't perfectly replicate it across execution contexts. Mimic's canvas delta between main thread and worker, GoLogin's WebGL renderer inconsistencies, Fraudfox's fill color modifications.

Impossible combinations at C14 fire for tools with aggressive cross-OS profile support. When a tool lets you claim to be a macOS Safari user while running on a Windows Chromium shell, contradictions multiply faster than patches can cover them.

No vendor is green across the board. Not one.

Vendor Graveyard: How Each Browser Got Caught

Multilogin Mimic: Overachiever That Tried Too Hard

Multilogin's Mimic engine is the gold standard of antidetect. Doesn't inject JavaScript like the cheap tools. Modifies Chromium at the source code level, recompiling the browser to return fake values natively. Significantly harder to detect than script injection. Mimic's developers clearly understand the game.

Harder doesn't mean impossible, though. And Mimic's attention to detail has a few blind spots.

First tell is canvas. Mimic generates canvas output that's close to real hardware output, but not identical. F02 canvas perceptual hash compares the main thread canvas output against an OffscreenCanvas rendered in a Web Worker. In a real browser, these match exactly. In Mimic, a consistent delta appears. Canvas modification happens at the rendering level but doesn't propagate identically to the worker context. C38 flags that discrepancy with an integrity_flag value of 2.

Second tell is network-level. Mimic runs on a modified Chromium build, but its HTTP/2 SETTINGS frame parameters don't match stock Chrome's. A18 catches the anomaly. SETTINGS frames are sent during connection setup, before any JavaScript runs, and Mimic's values diverge from Chrome's defaults. Networking code sits deep in the Chromium stack, far from where fingerprint spoofing usually happens.

Researchers at Stony Brook University, publishing through HAL Science in 2020, found a third tell. Even the HTTP Accept-Language header priority exposes Mimic. When Chrome sends multiple language preferences, the second language gets a quality factor of 0.9. Mimic sends 0.8. A difference of 0.1 in a header that nobody reads. All it took.

Babak Amin Azad et al., Taming the Shape Shifter: Detecting Anti-fingerprinting Browsers, Dimva 2020

Detection confidence: 0.91.

GoLogin: Prototype Betrayal

GoLogin takes a hybrid approach: some modifications at the Chromium level, some through script injection. Result is a browser where certain native functions have been swapped out, but the replacements don't perfectly replicate original prototype chains.

C48 prototype integrity check walks the prototype chain of critical navigator and window properties. In a real browser, navigator.platform is an inherited property on Navigator.prototype. In GoLogin, it's often an own property on navigator itself, defined via Object.defineProperty. Run navigator.hasOwnProperty('platform') on a real Chrome instance and you get false. Run it on GoLogin and you get true.

One such anomaly might be a fluke. Two raises eyebrows. GoLogin consistently yields five or more prototype anomalies across navigator, screen, and performance objects. Any session with that density of integrity failures gets flagged.

A toString reflection test drives it home. Call .toString() on a native function and you get function platform() { [native code] }. Call it on GoLogin's replacement and you see actual JavaScript code. GoLogin overrides toString to return the native code string, but they rarely override toString.toString. Check three levels deep and, at some point in the reflection chain, the mask slips.

GoLogin's own testing confirms the problem. In 2025, GoLogin published a comparison test and admitted that neither Pixelscan nor iphey passed basic fingerprint checks when verifying GoLogin profiles. When a tool vendor's own QA blog concedes that third-party verification services flag their profiles, detection has already won that round.

Detection confidence: 0.87.

Dolphin Anty: Messy Roommate

Dolphin Anty is popular in the CIS region and among social media marketers. Fingerprint spoofing is competent enough, but it has a housekeeping problem: it pollutes the global window object.

C50 global pollution check scans window for non-standard properties. A clean Chrome instance has a known set of global properties. Dolphin Anty adds its own, injected by the management interface that orchestrates profile switching. Not visible in the UI. Internal communication channels between the Dolphin shell and the modified browser core. Visible, however, to any script that enumerates Object.keys(window). Extra keys stick out like muddy boots on white carpet.

DataDome's research independently confirmed that detection vector, documenting inconsistencies in UA strings, WebGL, and Canvas fingerprinting specific to Dolphin Anty.

DataDome, Detecting Dolphin Anty

When global pollution AND CDP markers show up together, C50 returns confirmed automation. Not suspected. Confirmed.

Detection confidence: 0.94.

Linken Sphere: Proxy Trap Paradox

Linken Sphere takes a clever approach to API spoofing: it wraps navigator properties in JavaScript Proxy objects. Instead of redefining properties with Object.defineProperty, it intercepts property access through Proxy traps. Harder to detect through simple toString checks because Proxy objects can mimic native behavior at the surface level with convincing accuracy.

Proxy objects behave differently under edge-case operations, though. C49 proxy trap detection applies a battery of tests that split Proxy-wrapped objects from native ones. Certain error types differ. Certain operations that should throw on native objects succeed on Proxies, and the reverse. When a browser claims to be Chrome but its navigator object responds to edge-case operations like a Proxy instead of Chrome's native implementation, C49 fires.

Irony runs deep in Linken Sphere's approach. Proxy traps are meant to intercept access transparently. Interception itself leaves fingerprints. A trap designed to make things look normal is, under close enough scrutiny, abnormal.

Detection confidence: 0.78.

Undetectable: Ironic Name, Ironic Outcome

Castle.io published a detailed reverse-engineering analysis of Undetectable in March 2025. Short version: Undetectable injects approximately 2,500 lines of obfuscated JavaScript into every page.

Castle.io, Detecting the Undetectable Browser, March 2025

Injection serves multiple purposes. Monitors iframe creation through a MutationObserver. Overrides fingerprint-sensitive APIs. Communicates with the Undetectable shell to apply profile-specific spoofing.

Detection method is embarrassingly direct. Override document.getElementsByTagName and check the call stack. If the stack trace holds references to ready and iframeCheck, you've found Undetectable's monitoring script. A calling card. Undetectable named its own internal functions in a way that makes them identifiable. Naming things is hard. Naming things in a tool called Undetectable is harder.

For non-Chromium profiles, detection gets even simpler. When Undetectable pretends to be Safari, it uses Apple GPU values in WebGL but runs on a Chromium rendering engine. WebGL configuration is hardcoded as Angle (Apple, Angle Metal Renderer: Apple M2, Unspecified Version). Angle is a translation layer that only exists in Chromium-based browsers. Safari never reports Angle. Ever.

Detection confidence: 0.95.

AntiDetect and Fraudfox: Old Guard

Started the antidetect industry. HAL Science 2020 paper analyzed both in depth, and findings remain relevant because both tools still use the same fundamental architecture.

Azad et al., Taming the Shape Shifter, Dimva 2020

AntiDetect uses pure JavaScript injection. Every overridden object holds only toString in its property descriptor, detectable with Object.getOwnPropertyNames(). Chrome profiles show both webkit AND moz prefixed CSS properties at the same time. Like ordering borscht and a burger at the same restaurant, then insisting you've never left Kansas. Chrome uses webkit prefixes. Firefox uses moz. Both together means someone's lying.

Fraudfox directly poisons prototypes of specific objects, detectable through prototype chain inspection. Mac profiles list plugins with .dll extensions instead of .plugin. Canvas poisoning modifies fill colors in ways that are configurable through the UI. Here's the punchline: if a user reuses the same profile, the specific noise pattern becomes a persistent identifier. Defense becomes the fingerprint. Same mask, every single time.

One tool from that era genuinely resisted detection: Blink, which assembled a complete real environment in a virtual machine. No mimicking means no inconsistencies. Blink requires matching the victim's actual hardware, making it impractical for anything beyond targeted attacks. You can't run 500 Blink profiles for social media farming.

Detection confidence: AntiDetect 0.96, Fraudfox 0.93.

Rest of the Field: AdsPower, Kameleo, Incogniton, OctoBrowser

Four browsers, two camps.

AdsPower, Incogniton, and OctoBrowser lean on script injection as their primary spoofing mechanism. Makes them all vulnerable to the same family of detection methods: prototype chain integrity failures at C48, global scope pollution at C50, toString reflection revealing non-native code, and canvas integrity discrepancies at C38. Different brands, same disease.

Kameleo tries a different path with its Chroma engine, modifying Chromium more deeply. Dodges some script injection pitfalls but still produces HTTP/2 SETTINGS anomalies at A18 and headless-adjacent signals across A40 through A68. Screen dimension handling also creates detectable patterns: some profile configurations produce resolution combinations that no real device has ever shipped with. A 1366×768 screen with a DPR of 3.0 and 32GB of RAM. In what universe?

None survived the full 300+ signal analysis. Detection confidences ranged from 0.72 for Kameleo to 0.89 for OctoBrowser.

Camoufox: Open-Source Casualty

Camoufox deserves a separate mention, not as a commercial product, but as a warning. An open-source Firefox-based antidetect browser that went through a year-long maintenance gap due to personal circumstances of its maintainer. By early 2026, its Firefox base was outdated, and newly found fingerprint inconsistencies had degraded its detection resistance. A structural problem laid bare: antidetect tools require constant upkeep to keep pace with browser updates and new detection methods. Miss a few months, and the disguise starts to rot. Miss a year, and you're wearing last season's costume to a new masquerade. Commercial vendors with full-time teams struggle to keep up. Solo open-source projects have almost no chance.

Impossible Combinations Matrix

Beyond vendor-specific artifacts, a category of detection that's almost philosophical: certain combinations of browser properties simply cannot exist in reality. Antidetect tools let users pick from dropdown menus of OS, browser, and hardware options. Tools trust users to pick coherent combinations. Users don't.

C14 maintains a matrix of these impossible combinations. Here are the ones that catch antidetect browsers most often.

Castle.io, The Role of WebGL Renderer in Browser Fingerprinting

OS and GPU mismatches. A User-Agent claiming Windows paired with an Angle Metal Renderer: Apple M2 in WebGL. Metal API exists only on macOS. A User-Agent claiming Android paired with Apple GPU. Apple GPU reports only appear on macOS and iOS devices. A Linux User-Agent with Angle Direct3D11 in the renderer. Angle with DirectX translation only runs on Windows. Mismatches happen because tool users pick Windows 10 from one dropdown and a powerful-sounding GPU from another, not grasping they've just assembled a computer that doesn't exist.

Browser and engine mismatches. A Chrome User-Agent with moz-prefixed CSS properties. Belong to Firefox's Gecko engine. A Firefox User-Agent with webkitRTCPeerConnection. Safari and Chrome use webkit prefixes. Firefox doesn't. A Chrome User-Agent with a Firefox-format Error.stack. V8 and SpiderMonkey format stack traces differently, and no amount of User-Agent spoofing changes which engine actually runs the code.

Device and capability mismatches. A mobile User-Agent with maxTouchPoints: 0. Every phone and tablet on the market supports touch. A 64-bit OS in the User-Agent but navigator.platform returning Win32. Windows plugins with .plugin extensions, or Mac plugins with .dll extensions. File extension reveals which OS actually built the plugin directory.

Not heuristics. Logical impossibilities. No amount of JavaScript spoofing can make a Windows GPU claim coherent when the WebGL renderer string exposes Apple Metal hardware. Laws of physics are on the detection side. Impossible combination detections carry heavy weight in the C-score because they produce virtually zero false positives. Real browsers don't generate these clashes. Only tools that let users assemble Frankenstein profiles do.

Server-Side Wall: Where JavaScript Can't Help

Everything discussed so far happens in the browser, where antidetect tools have home-field advantage. Control over the JavaScript environment, the DOM, the rendering pipeline. A wall exists that they can't climb, though: the network layer.

JA4 TLS Fingerprinting. When a browser opens an HTTPS connection, the very first packet holds a fingerprint. Client Hello includes cipher suites, their order, extensions, and supported groups. A05 captures the JA4 fingerprint, and C12 cross-references it against the claimed browser in the User-Agent.

Stock Chrome on Windows has a specific JA4 signature. Stock Chrome on macOS has a slightly different one. Firefox has its own. Safari has its own. When a browser claims to be Safari in its User-Agent but sends Chrome's TLS Client Hello, game's over. Handshake happens in the network stack, below the browser's JavaScript layer, where antidetect modifications don't reach.

HTTP/2 SETTINGS Frame. Right after TLS, the browser sends its HTTP/2 connection preface, including a SETTINGS frame with parameters like HEADER_TABLE_SIZE, MAX_CONCURRENT_STREAMS, INITIAL_WINDOW_SIZE, and MAX_HEADER_LIST_SIZE. Each browser uses different defaults. A18 captures these values. Modified Chromium builds often forget to match stock Chrome's SETTINGS frame exactly, because parameters sit deep in the networking code, far from the fingerprint spoofing layer. Developer who spent three weeks perfecting navigator.platform spoofing didn't think about HTTP/2 connection parameters.

TCP Fingerprinting. Before TLS even begins, the TCP SYN packet itself holds OS-level signals. Initial window size, MSS value, TCP options order, TTL value, and Don't Fragment bit all vary by operating system. Linux defaults to TTL 64. Windows uses TTL 128. A kernel-level eBPF program can identify the real OS from the very first packet. JA4T format by FoxIO standardizes these signals, and Alberto Ventafridda demonstrated a practical fast TCP fingerprinting implementation via eBPF in June 2025.

All of that happens before a single byte of HTTP traffic flows. Before any JavaScript runs. Before the antidetect browser even gets a chance to start lying.

VPN overlay adds another signal. VPN tunnels reduce the MSS by their encapsulation overhead. A residential IP with an MSS of 1380 instead of the standard 1460 screams VPN tunnel. A06 detects MTU and TTL patterns consistent with VPN tunnels, and A31 can identify the specific protocol: WireGuard, OpenVPN, or others.

Server-side wall is why the antidetect arms race is fundamentally asymmetric. Vendors can spend years perfecting their JavaScript environment, but the network stack talks first, and it talks honestly.

CDP Detection Is Dead. Nobody Held a Funeral.

For two years, Chrome DevTools Protocol detection was the industry's favorite trick. Technique was elegant: define a property getter on an Error object's .stack property, log the error to console, and check if the getter fired. When CDP's Runtime.consoleAPICalled event was active, Chrome would serialize the Error object and trigger the getter. Detection in three lines of code.

May 2025, the V8 team killed it.

Castle.io, Why a Classic CDP Bot Detection Signal Suddenly Stopped Working, August 2025

Two commits on May 7 and 9, 2025 introduced a check: before reading error properties during preview, V8 now verifies whether the getter is user-defined. If it is, V8 skips it. Stated reason sounded innocent enough: prevent side effects during error preview. Practical effect was that DevTools became undetectable through that method.

V8 team effectively decided that developer tools should not be distinguishable from their absence. A reasonable engineering position. A devastating blow to bot detection.

Automation detection never leaned solely on CDP. navigator.webdriver flag is trivially bypassed with a single launch flag. CDP detection was a bonus signal, not the bedrock. Bedrock was always multi-signal consistency checking across fingerprint, consistency, and anonymizer axes, not one clever trick. With CDP gone, behavioral and prototype integrity signals became primary.

A lesson the industry learned the hard way: any detection method hanging on a single browser implementation detail will eventually break. Detections that survive are structural, checking whether the browser's story adds up across hundreds of data points.

Detection Arsenal: Check by Check

For antidetect detection specifically, these checks carry the weight.

Automation Detection, A19. Checks navigator.webdriver, headless UA hints, chrome.app presence, and CDP markers. CDP component is deprecated since May 2025, but remaining signals catch tools that forget to disable the webdriver flag or strip the headless hints.

Headless and Antidetect Markers, A40 through A68. Twenty-three individual checks for automation artifacts. No taskbar at A40. Visual viewport equals screen at A41. PDF viewer disabled at A46. Missing Web Share API at A47. Chrome runtime anomalies at A51. Empty speech synthesis voices at A63. No media devices at A64. Keyboard API absent at A66. Each check alone has limited value. Together, they form a constellation that's extremely hard to fake wholesale. You can patch five of these. You can patch ten. Patching all twenty-three, across every profile configuration, without spawning new inconsistencies? Where vendors crumble.

Prototype Integrity, C48. Walks native prototype chains, checks for patched critical functions, and returns an integrity score. Single most effective check against script injection tools. Six of eleven vendors fail here.

Global Pollution, C50. Scans window for non-standard properties. Combined with CDP markers, produces a confirmed automation verdict. Catches Dolphin Anty, AdsPower, and any tool that injects management scripts into the page.

Proxy Traps, C49. Detects Proxy-based API substitution through edge-case behavioral tests. Catches Linken Sphere and tools using the Proxy pattern for property interception.

Impossible Combinations, C14. Matrix of physically impossible signal combinations described above. Virtually zero false positives.

Canvas Integrity, F02 and C38. Perceptual hash comparison between main thread and Web Worker canvas rendering. Catches Multilogin Mimic's canvas delta and extension-based canvas noise injection. When main thread and worker produce different hashes, integrity_flag hits 2.

Network Layer, A05, A18, and C12. JA4 TLS fingerprint capture, HTTP/2 SETTINGS anomaly detection, and JA4 vs. User-Agent cross-reference. Server-side wall that no JavaScript modification can breach.

Commercial detection is catching up too. Fingerprint.com's Browser Tampering Detection Smart Signal explicitly targets antidetect browsers as a product feature, flagging sessions where browser properties have been modified from their native values. When the largest commercial fingerprinting provider builds a dedicated antidetect detection product, the market has spoken: detecting the disguise is now as profitable as selling it.

Behavioral Analysis, C27 through C30. Mouse movement patterns at C27 and C28, click timing at C29, and scroll behavior at C30. Research from Georgetown University et al. published in PoPETs 2025 showed that behavioral fingerprinting eliminates 84 to 95% of anonymity from a single session observation. Separately, within the first 60 seconds of interaction a user loses 78 to 85% of anonymity. Signals serve as a confidence multiplier rather than a primary detection trigger.

Crichton et al., Rethinking Fingerprinting: Behavior-based Methods at Scale, PoPETs 2025

Arms Race: What Comes Next

Antidetect industry isn't standing still. Neither is detection. Trajectories aren't symmetric, though.

Cross-referencing as doctrine. A January 2026 blog post on chameleon mode detection articulated the principle driving the industry now: no single signal catches a well-configured antidetect browser. Detection works by cross-referencing dozens of signals at once. Canvas hash alone proves nothing. Canvas hash combined with a WebGL renderer mismatch, an unusual prototype chain, and a JA4 signature that doesn't match the claimed browser: that proves everything. Detection has moved from find the smoking gun to find the hundred small contradictions.

Deeper Chromium forks. Next generation of antidetect browsers will move away from script injection entirely. Fork Chromium at a deeper level, modifying the networking stack to match stock Chrome's TLS and HTTP/2 behavior. Some vendors are already working on exactly that. Raises the cost of producing each new browser version steeply, but would close the server-side gap. Question is whether vendors can keep pace with Chrome's release cycle. Chrome ships a new version roughly every four weeks. New TLS signature, new HTTP/2 defaults, new SETTINGS values. Every four weeks. Keeping up is a full-time job for a full-time team.

Behavioral analysis as primary detection. With CDP dead and JavaScript environment spoofing getting better, behavioral analysis is becoming the differentiator. Mouse movement patterns follow neuromotor laws that are biologically expensive to simulate. Research published in Pattern Recognition in 2022 showed that even GAN-generated mouse trajectories, visually indistinguishable from human ones, are still detectable at 93% accuracy because they lack micro-level timing patterns inherent to human muscle control.

Acien et al., BeCAPTCHA-Mouse: Synthetic Mouse Trajectories and Improved Bot Detection, Pattern Recognition 2022

Google's own SearchGuard system, revealed through the SerpAPI lawsuit in January 2026, sets hard thresholds: mouse velocity variance below 10 flags as bot. Scroll delta variance below 5 pixels flags as bot. Key press duration variance under 5 milliseconds flags as bot.

Search Engine Land, Inside Google SearchGuard, January 2026

Thresholds target the mechanical consistency of automation tools. Real human movements are messy, variable, governed by neuromotor noise that costs computational effort to replicate. Most antidetect browsers don't even try to randomize interaction patterns. An open lane for detection.

Hardware-level fingerprinting. WebGPU is opening a fingerprinting frontier that no software spoofing can address. Research presented at ACM WiSec 2025 demonstrated 70% device re-identification accuracy from a pool of 500 devices using WebGPU compute shader probing alone. Fingerprint comes from manufacturing-level silicon variations between GPUs. Two identical GPUs from the same production line produce distinguishable timing signatures. No software can change how your silicon processes atomic operations.

Hohentanner et al., Unveiling Privacy Risks in WebGPU, WiSec 2025

Drawnapart research from NDSS 2022 proved the concept earlier: even nominally identical GPUs can be told apart through execution unit timing analysis. Canvas randomization is completely irrelevant to that vector. Fingerprints the hardware, not the rendering output.

Laor et al., Drawnapart: A Device Identification Technique based on Remote GPU Fingerprinting, NDSS 2022

Machine learning classification. IMC 2024 paper Browser Polygraph demonstrated ML-based fraud browser detection at web scale using coarse-grained fingerprints rather than single-point hash matching. Detection side already trains three models daily: a binary classifier for real vs. antidetect, an anomaly detector for unknown threats, and a tool classifier that identifies the specific vendor. Antidetect vendors are training against static detection rules. Detection side is training against them, with more data every day.

Kalantari et al., Browser Polygraph, IMC 2024

FAQ

Can antidetect browsers be detected? Yes. Every one of the 11 antidetect browsers tested was detected with confidence ranging from 0.72 to 0.98. Detection works through four tiers: vendor-specific artifacts, impossible signal combinations, privacy-vs-antidetect differentiation, and generic automation markers. Castle.io reverse-engineered Undetectable's 2,500 lines of obfuscated JS, and DataDome documented Dolphin Anty's detection vectors.

Which antidetect browser is hardest to detect? Linken Sphere scored the lowest detection confidence at 0.78, thanks to its Proxy-based API spoofing which avoids simple toString checks. Proxy objects behave differently under edge-case operations, though, and those differences are detectable. Multilogin Mimic scored 0.91, impressive engineering betrayed by canvas deltas and HTTP/2 anomalies. No vendor achieved a clean pass.

What is the four-tier detection hierarchy? Tier 1, Vendor Flavor, identifies the specific antidetect tool by its unique artifacts. Tier 2, Signal Combination, catches impossible parameter combinations like Android UA and Apple GPU. Tier 3, Privacy vs. Antidetect, distinguishes privacy tools that reduce signals from antidetects that add fake ones. Tier 4, Generic, catches automation via headless markers, prototype integrity failures, and global pollution. Each tier uses fundamentally different signals.

What are network-layer tells and why can't antidetects fix them? JA4 TLS fingerprint, HTTP/2 SETTINGS frame, and TCP-level OS detection all happen below the JavaScript layer. Antidetect browsers control the JS environment but not the network stack. A browser claiming Safari via User-Agent but sending Chrome's TLS Client Hello is caught instantly. TCP TTL of 128 for Windows and 64 for Linux reveals the real OS. Fixing that requires modifying the browser's compiled networking code, an order of magnitude harder than JS spoofing.

How do prototype chain checks work? In a real browser, navigator.platform is an inherited property on Navigator.prototype. Antidetect tools often redefine it as an own property via Object.defineProperty. Running navigator.hasOwnProperty('platform') returns false in stock Chrome and true in modified browsers. Checking toString on native functions reveals [native code] vs. actual JS code. Going three levels deep with toString.toString catches tools that override the first level but forget the second. Six of eleven tested vendors fail prototype integrity checks.

Bottom Line

Eleven vendors. Hundreds of profiles. Thousands of dollars in subscriptions.

Every one detected.

Tools are getting better. Detection is getting better faster. Server-side wall isn't going anywhere. Hardware fingerprinting is arriving. Behavioral analysis is maturing. And the gap between good enough to fool a basic check and good enough to fool 300+ signals is widening, not narrowing.

An antidetect browser is a disguise. Disguises work best when nobody's looking closely.

Everybody's looking closely now.