Anti-detect browsers on rewards sites: how GoLogin, AdsPower and Multilogin farms are caught
An anti-detect browser is the tool behind most multi-account farms on GPT sites and offerwalls. Each profile gets its own user agent, screen, timezone, canvas noise and proxy, so every account looks like a different person. They are good at it, but they run on real computers, and some things about that computer leak through. In 30 days of traffic on rewards and offerwall sites, 37 of 39,780 devices claimed an operating system that their own graphics chip ruled out, and most of their events had passed every other check.
Short answer
Anti-detect browsers rewrite what a page can ask: user agent, platform, screen, fonts, canvas, timezone and WebRTC. They are caught by what they forget to change or cannot change: a graphics backend the claimed system does not have (Direct3D on a "Mac" or a "phone"), an engine that does not match the claimed browser version, rewritten native functions, a clock or language that does not fit the IP, and a form filled by automation instead of a hand.
- Devices with impossible graphics
- 37 of 39,780 in 30 days (0.09%).
- "Phones" drawing through Direct3D
- 32: Windows PCs posing as Android or iPhone.
- Their events allowed by other checks
- 13 of 21.
- Gap between keys, automation vs a person
- 15 ms varying by 1 ms, against 199 ms varying by 159 ms.
What an anti-detect browser does
GoLogin, AdsPower, Multilogin, Dolphin Anty, Incogniton and similar tools are builds of Chromium or Firefox that start every "profile" with a different identity. A profile carries its own cookies and storage, a chosen user agent and operating system, a screen size, a language list, a timezone, a set of fonts, noise added to canvas and audio readings, a WebRTC setting and its own proxy.
Agencies use them to manage many ad and social media accounts they own. On a rewards site they are used for one thing: making fifty accounts look like fifty people. Pair each profile with a residential proxy in a high-payout country and the classic checks go quiet. The IP is a home connection, the cookies are new, and the fingerprint hash is different every time. A site that only checks IP reputation and cookies pays every one of those accounts.
What they fake well
- User agent and platform. A Windows profile on a Mac says Windows everywhere the page asks for the system name.
- Screen and window size, set to common values so the profile blends in.
- Timezone and language, matched to the country of the proxy.
- Canvas and audio readings, with small random noise, so the usual fingerprint hash changes per profile.
- WebRTC, switched off or made to report the proxy address, so the real IP does not leak.
- Fonts, trimmed to a list that fits the claimed system.
Checking any one of these against a decent anti-detect browser is a waste of time: the tool was built to pass exactly that check. What holds are the combinations, and the parts that come from the machine itself.
The graphics chip: the part they forget
Every browser draws through a graphics backend, and the WebGL renderer string names it. Chrome on Windows draws through Direct3D, so its renderer reads like "ANGLE (NVIDIA, GeForce RTX 3060 Direct3D11)". Macs draw through Metal or OpenGL. Phones draw through OpenGL ES on an Adreno, Mali or Apple GPU. A profile can claim any system it likes, but unless the tool also replaces the renderer string, the real backend shows up next to the fake system.
| Claimed system | Renderer seen | What it really is |
|---|---|---|
| Android phone | ANGLE (Intel, UHD Graphics, Direct3D11) | A Windows PC: an emulator or a desktop posing as a phone |
| iPhone | ANGLE (NVIDIA, GeForce GTX 980, Direct3D11) | A Windows gaming PC |
| Windows | ANGLE (Apple, Metal Renderer: Apple M2) | A Mac running a Windows profile |
| macOS | ANGLE (NVIDIA, GeForce RTX 3060, Direct3D11) | A Windows PC running a Mac profile |
In 30 days of traffic on rewards and offerwall sites we found 37 such devices among 39,780: 32 "phones" drawing through Direct3D and 5 desktop profiles with another system's graphics. They matter more than their number suggests. The "phones" were reaching mobile-only offers, which usually pay more, and 13 of the 21 events from these devices had passed every other check.
Real setups do not trigger it. Windows running in Parallels or Boot Camp on a Mac reports a Windows graphics driver, as a Windows machine should. Linux on Apple silicon reports its Apple GPU on Linux, which is real hardware. Only combinations that no real machine produces count.
Engine, functions and clocks
- The engine does not match the version. A profile that says Chrome 129 but lacks features Chrome shipped years earlier, or has features that arrived later, is another engine wearing that name.
- Rewritten native functions. To report fake values, the tools replace the browser functions that return the platform, the screen or the GPU. A replaced function does not look like a built-in one, and the page can see the difference.
- A clock that does not fit. The timezone is easy to set. The language list, the way dates are formatted and the IP country all have to agree with it. A US home IP with a clock from Dhaka in one place and from New York in another is a profile set up in a hurry.
- Storage that comes back. A new profile has no storage, yet the same hardware returns under a new account minutes later.
Each of these is weak on its own, because privacy extensions also rewrite a few functions and travellers have odd clocks. Together, and next to a farm pattern on residential proxies, they are strong.
How the form was filled
Farms rarely type every signup by hand. They drive their profiles with Puppeteer, Playwright or the tool's own automation, and that leaves a different trace from a person. We drove a real Chrome both ways through the same signup form. The person moved the mouse 105 times for three clicks and typed with gaps of about 199 ms that varied by 159 ms. The automation moved the pointer once per click, straight onto each field, and typed with 15 ms gaps that varied by 1 ms.
A script that fires events itself is even easier to spot: the browser marks those events as not coming from the user. Only counts and timings are needed for any of this: how many moves, clicks, touches and key presses, and the gaps between keys. Never which key was pressed or what was typed.
What to do on your site
- Scan at signup and at the money moments. Offer clicks, conversions and cashouts are where a farm gets paid. A scan only at signup misses profiles that change between visits.
- Scan when the form is sent, not only when the page opens, so the way it was filled is part of the check.
- Hold before you ban. Put signups and cashouts with these signals in review first, look at the evidence, then block. Farmers learn fast from instant bans.
- Look at the group, not the account. When one profile is caught, check the accounts that share its payout wallet, its hardware or its offer pattern. Farms rarely run one account.
CashoutGuard reports these as "Fake phone model" (a phone that draws through Direct3D), "Browser tampering" with gpu_os_lie (a desktop system with another system's graphics) and "Scripted page use" (synthetic events, machine typing or a pointer that only jumps onto buttons), next to the existing checks for emulators, VPNs and linked accounts. See also cloud phone farms and how to detect multi-accounts.