How do anti-fraud systems understand that you are changing your digital fingerprint

Lord777

Professional
Messages
2,581
Reputation
15
Reaction score
1,325
Points
113
On the web, you can often find user reports that various scanners detect the use of anti-detection. However, the reason for this may be not only in the browser, but also in the user's actions. We collected all the basic parameters that make it clear that the user is replacing fingerprints and suggested ways to reduce the risk of detection. 🤏

Why are there any problems with emulation at all 😐

Any antidetect has two key functions:
  • Spoofing a fingerprint. Anti-detection should change the real data user's .
  • Emulation. Make you look as much like a regular user as possible.
The truth is that so far there is not a single anti-detection tool in the public domain that can completely turn you into a regular user.

This is due to the fact that each antifraud system has its own unique mechanisms of operation: they analyze different amounts of data, in different order, and draw conclusions from this data in different ways. And just because of this, it happens that one anti — detection is better suited for conditional Twitter, and the other-for Zuckerberg's social network.

At the same time, there are some recommendations that you can follow to significantly increase the quality of emulation.

The main parameters that make the replacement of fingerprints visible​

Below are the main parameters that most often show data substitution:

1️ ⃣ IP — thisis one of the most popular parameters that causes problems.

What's the problem
  • The real IP address is not hidden. Some users think that anti-detection automatically changes their IP address. In fact, anti-detection tools have functionality for changing data, but the new IP address itself needs to be taken somewhere. To do this, you need to buy a proxy or VPN. Some browsers have a built-in proxy purchase option from the company's partners.
  • They use a proxy for the wrong geo. For example, a user plans to work with Brazilian users and creates a Brazilian account, but buys Russian proxies. As a result, their data is identified as Russian, which may cause problems on the site.
  • They buy unsuitable proxies. In order to save money, users buy cheap proxies or use free ones altogether. In this case, there is a risk that the IP address has already been used for many places and is blocked by most popular sites. Moreover, such proxies can be dangerous because they can be used by intruders.

What to do
  • When working with anti-detection, use a proxy, otherwise your real IP address will not be masked.
  • Buy proxies only from trusted sellers.
  • Make sure that the IP address matches your account's geo.
  • Choose a proxy based on your tasks. The most secure ones are proxies with HTTPS and SOCKS5 protocols. However, if you need a lot of IP addresses for different profiles, it is better to choose mobile proxies. They are more expensive, but due to the ability to update the IP, they can be much cheaper.

2. Fonts -one of the main parameters that indicates the fact of spoofing the print.

What's the problem

Each operating system has a set of fonts used: standard and system fonts. Standard fonts include well-known fonts: Arial, Times New Roman, etc. Their peculiarity is that they are found in any operating system.

But system fonts can be unique for each specific system.

How it works: let's imagine that the user has a Windows laptop, but the digital fingerprint indicates macOS. Due to differences in system fonts, anti-fraud systems will understand that it encrypts its digital fingerprint. Moreover, the difference will be visible not only in the font set itself, but also in their design: macOS and Windows can display even the same font differently.

What to do
  • If possible, select the operating system of the device you plan to use in the digital fingerprint of the anti-detection device.
  • If you have a powerful PC and laptop, install Linux as the second operating system, then install the system fonts of the OS you need on it. Linux acts as an intermediate system between Windows and macOS, so you can use it to smooth out font differences.

3, The browser. All anti-detection tools work on the basis of a standard browser. This is usually Chrome, Chromium, or Firefox. Chrome is the same Chromium, only with Google services enabled and some changes in the internal functionality of the browser.

What's the problem

Each browser has its own unique parameters and features that distinguish it from others. Ordinary users will not notice these features, but they will definitely be seen by anti-fraud systems. This way they will know that the user is spoofing the fingerprint.

What to do

Make sure that your digital fingerprint contains data that matches the anti-detection browser. This is shown in Useragent. All manufacturers of anti-detection tools announce which browsers they work on. For example, Dolphin{anty} runs on Chromium.

4, Device characteristics. Some users, in an attempt to convince antifraud of the reality of their fingerprint, change the parameters of the device itself: Audio, Canvas 2d(just Canvas), Canvas 3d, etc.

What's the problem

The fingerprint can become:
  • unrealistic, because the device's fingerprint parameters are linked, manual changes may result in a combination of data that doesn't occur at all or is too rare.
  • too unique, which will attract the attention of anti-fraud systems.
What to do

Do not change the fingerprint settings that relate to the device itself: Canvas, Audio, WebGL.

5. WebRTC —describes parameters for transferring audio, video, and content between browsers and applications. The project was used as a replacement for Flash.

What's the problem

It often happens that this parameter shows your real IP address, even if you are using a proxy.

What to do

If you see a leak of your real IP over WebRTC, the best solution is to ask the anti-detection developer what is best to do with this parameter. This is due to the fact that some anti-fraud systems see that a person changes the IP address, but do not take any measures against the user. This is especially true at the current time, when many sources and websites in Russia are blocked.

6. Mobile device on the web. Some users are trying to emulate a mobile device using web versions of anti-detection tools.

What's the problem

Mobile devices differ from web versions by hundreds of parameters, including screen resolution, network operation, data transfer methods, device type, and so on. Given that anti-detection doesn't provide 100% emulation even on the web version, it will be even lower with the mobile version.

What to do

Even if your antidetect has functionality to emulate the web version for mobile, it is best to use it with caution and not test it on important accounts. Otherwise, there is a risk that they may be sent for verification or even blocked.

And finally 👌 🏼

Before you start solving your tasks in a specific anti-detection:
  • Thoroughly test the anti-detection device during the trial period. It is better not to use combat accounts immediately, because if the anti-detection does not work, you can reduce the trust of your account or even lose it altogether. Even better, if the anti-detection service has a free plan: then you will have more time for testing. For example, has a completely free plan for 10 browser profiles.
  • Check the quality of protection through scanners. It is better to check through several scanners to get a more complete picture. At the same time, it is important that crawlers give a general idea of what data can potentially be seen by site security systems. In fact, each anti-fraud system has its own algorithms: just because the scanner shows 100% authenticity does not mean that you will pass the anti-fraud check and vice versa.
  • If you have just started using anti-detection, read our article about what mistakes users make when working with the anti-detection browser.
 
Top