The Mosaic blog
News from the product, the engineering behind it, and the reasons we made the calls we made.
Headless is not a way to hide, it is a way to be seen
Headless Chrome names itself HeadlessChrome in its user agent and drops the real GPU. Why our background work runs headed, off-screen, instead.
Half a spoof is a contradiction
Partial fingerprint spoofing detection is simple: ask one question two ways. We cut five spoofs that changed one route to a value and left the other.
Why the parts of a profile have to agree
Fingerprint, proxy and cookies consistency: sites compare the three, and each can look fine alone while together they describe nobody.
Chromium's mock keychain, and why we encrypt the store
Chromium's --use-mock-keychain keeps cookie encryption on but uses a password from its own source. We read a live session cookie off disk, then sealed it.
The RTT client hint, read off the wire
ECT, RTT and Downlink headers behind a proxy, measured: a claimed round trip moved JavaScript to 300 and left the RTT header at 50. So we claim neither.
The warm-up robot that left a bot signature
Our warm-up robot scrolled with window.scrollBy, so pages saw isTrusted false and a scroll with no wheel. How a page detects that, and what we changed.
Why we built our own Chromium instead of injecting JavaScript
Mosaic changes fingerprint values in C++ inside its own engine. Three measured differences between Chrome and plain Chromium explain why that matters.
Reading a proxy seller's grammar off one pasted line
Proxy sellers put country, session and lifetime in the username. Mosaic reads the grammar off the line you paste and keeps every token it does not know.
Importing other browsers' libraries by shape, not file name
To migrate anti-detect browser profiles, Mosaic reads which product wrote the file from its fields, keeps what that product recorded and draws the rest.
The values every profile inherited from this Mac
A browser fingerprint value inherited from the host is identical across two unrelated profiles and equal to the computer. That test found dark mode and more.
A downloaded file is evidence of its profile
With several browser profiles, one shared Downloads folder mixes every profile's files and outlives them. Mosaic gives each profile its own folder instead.
Switching between client accounts in seconds, not sign-ins
Signing out and back in is where a client switch costs minutes and where wrong-account posts start. A shortcut per client profile makes it one double-click.
Amazon Ads Partner Network access, for agencies
Amazon Ads Partner Network access lets an agency link clients' ad accounts to its own manager account, so nobody hands over a Seller Central password.
Chrome 136 stopped remote debugging on your default profile
Since Chrome 136, --remote-debugging-port is ignored on the default profile. Pass --user-data-dir with a folder of its own and the port opens.
Why hCaptcha gives some browsers a puzzle every time
hCaptcha's challenge is its score. A puzzle every time usually means blocked cookies, a crowded VPN exit or a browser whose values disagree with each other.
Seeing the notification prompt again, as a new visitor would
Chrome asks a site once and keeps the answer, so the tester sees nothing next time. Reset the site's permission, or open a profile that has never visited.
Detecting a proxy with two clocks
A server times the TCP handshake to the exit and a round trip to the browser. Behind a proxy the second is longer, and the gap is the tunnel.
Trashing a profile closes its browser, at every door
Delete a running profile in Mosaic and its browser closes first. If the browser will not close, the profile stays on the list, with its Stop button.
"Unlimited bandwidth" proxies and where the limit really is
An unlimited bandwidth residential proxy still has a limit. It moves to threads, ports, speed or a fair-use clause, and the terms say which one.
Why navigator.webdriver is true, and why false proves little
navigator.webdriver is true because automation set it on purpose. We measured a debug-attached Chrome reading true and still scoring 100 on IPHey.
Letting an AI assistant run browser profiles over MCP
Mosaic's MCP server lets Claude or any MCP client create, start and drive browser profiles. Three faults we found when a model was the caller.
Amazon Associates and several websites: one account, many tracking IDs
Amazon Associates wants one account per person, with every site listed in it and a tracking ID for each. A second account for a second site breaks the rules.
fingerprint-scan.com bot score: 0 before anything was measured
fingerprint-scan.com shows Bot score 0/100 while its hash still reads collecting. Read the score only after the hash exists, and expect 15, not 0.
App-Bound Encryption, and why tools stopped reading Chrome's cookies
App-Bound Encryption ties Chrome's cookie key on Windows to Chrome itself, so tools reading the Cookies file broke. Export from inside the browser.
A retired bot test can still answer 200 and look like a pass
Antoine Vastel's fp-scanner demo now serves his homepage with HTTP 200, which a challenge reader scores as a pass. His tests moved; here is where.
Why every Mac's Chrome says Mac OS X 10_15_7
Chrome froze the macOS version in its User-Agent, so every Mac claims 10.15.7. The real one is in Sec-CH-UA-Platform-Version, a hint sites must ask for.
The proxy bill is usually bigger than the browser bill
Past a couple of dozen profiles, the exits cost more each month than the anti-detect browser. That is why we price per month, not per profile.
Seeing both sides of your own A/B test
Testing tools put each visitor in one variant by a cookie or id and keep them there. To see every variant, keep one browser profile per variant for the test.
Through a proxy, your TCP fingerprint is the exit's
A proxy's exit opens its own TCP connection, so the TTL, window and options a site reads come from the exit's system, not your browser or your computer.
Why the User-Agent says Windows 10 on Windows 11
Windows 11 and 10 both send Windows NT 10.0 in the User-Agent. Only the platformVersion client hint, 13 or higher, says Windows 11.
Why Amazon verifies new sellers on a video call
Amazon seller video verification puts a face beside the ID and statement you uploaded. After it, two accounts are linked by the person, not by the browser.
Amazon's unified account in Europe, explained
Amazon's unified account in Europe is one Seller Central login for every European store, so selling in five countries needs one account, not five.
Why Chrome's User-Agent says 0.0.0
Chrome zeroes everything after the major, so the User-Agent says 0.0.0 and the build moves to Sec-CH-UA-Full-Version-List. A real build in the UA is a tell.
Device-bound sessions and the end of copying a cookie
With Device Bound Session Credentials in Chrome, a site reissues its session cookie only to the device with the key. A copied cookie lasts until it expires.
How to test a metered paywall as a new visitor
A meter can count by cookie, by login, by address or by fingerprint. To test yours as a new visitor you need a browser that is new to every one of them.
MSS 1300: what an MSS value says about VPN detection
VPN detection by MSS value: a tunnel shrinks the MSS in every SYN. A proxy opens a new connection at the exit, so a site reads the exit's MSS.
Per-GB vs per-IP proxy pricing for long-lived profiles
Per GB vs per IP proxy pricing over a year: a light profile is cheaper per GB, a busy one per IP, and the crossover is lifetime gigabytes against months.
How much proxy traffic a browser profile uses
How much proxy traffic do you need? It follows the pages a profile loads, not the profile count. Measure one profile for a week, then multiply.
A detector that never answered because its tab was in the background
Background tab throttling stops requestAnimationFrame. Our test tab was in the background, two detectors never answered, and Page.bringToFront fixed both.
Why Mosaic profiles never claim Edge
Our Edge profiles sent either a full build in the User-Agent or an empty Sec-CH-UA-Bitness client hint. No real Edge sends either, so we refuse Edge.
Brand Registry agents: running a brand you don't own on Amazon
Amazon Brand Registry agent access: the trademark owner invites the agency's own account in User Permissions and picks its roles. No password changes hands.
Behaviour tests score your mouse, not just your browser
A behavioral bot detection test scores mouse paths and dwell next to browser attributes. Load one and touch nothing, and the score describes your stillness.
Chrome's IP Protection was cancelled, and proxies stay your job
Chrome's IP Protection would have proxied some Incognito traffic to known trackers. Google retired it with Privacy Sandbox, and sites still see your IP.
An IPv4 and an IPv6 address from one proxy is one exit
A proxy that shows both an IPv4 and an IPv6 address is a dual-stack exit. Sites see either one, so look both up before you trust the location.
49 browser fingerprint detectors, and how we read them
Our browser fingerprint detectors list: 49 public test pages in five groups, 40 read by a script and 9 kept as reference because they print no verdict.
A fresh browser for every test run, and why it should be cheap
Leftover cookies and storage are where flaky browser tests come from. A one-time profile gives each run a clean jar and trashes itself when its browser closes.
IPv6 proxies, and why a site may count a /64 as one house
IPv6 proxies are cheap because addresses are plentiful, but sites that score IPv6 count a /64 prefix as one household. Many addresses from one prefix are one.
What a proxy costs per profile per month
Proxy cost per account depends on how the seller bills. Worked sums for per-GB, per-IP and per-port plans at one, ten and a hundred profiles.
Keeping twenty QA test accounts straight
Managing test accounts for QA goes wrong when the state lives in people's heads. Give each persona a profile with its login, role and state beside it.
Your dark mode is sent as a request header
Sec-CH-Prefers-Color-Scheme sends your dark mode setting to any server that asks. On our profiles it carried this Mac's own settings, until each drew its own.
Amazon's 'legitimate business need' clause, read closely
Amazon allows a second seller account only for a legitimate business need, with every account in good standing. Two businesses qualify; a backup never does.
Chrome kept third-party cookies. What that means for cookie jars
Chrome is not removing third-party cookies: Google dropped the phase-out and then the prompt. A jar per account matters as much as it did before.
What cloud sync costs an anti-detect browser
Cloud sync puts every logged-in session you run in one vendor's database. Mosaic keeps profiles on your disk instead, and pays for it in three ways.
Checking your cookie banner from the countries that require it
Consent tools pick the banner by the visitor's IP location, so your office sees one version. Test each region from a fresh profile with an exit there.
A DNS server in another country is not always a leak
Our US exit resolved through Google in Germany, and nothing leaked. A foreign resolver in a DNS leak test matters only if it is your own ISP's.
Privacy Sandbox is retired, and its APIs are a version tell
Chrome is removing Topics and Protected Audience release by release, so whether runAdAuction exists tells a page which Chrome you really are.
Residential proxy prices, turned into a cost per profile
Residential proxy prices are quoted per GB and move with plan size and the market. What an operator budgets is gigabytes per profile, times the rate.
setUserAgentOverride without metadata wipes your client hints
Without userAgentMetadata, setUserAgentOverride left our page with empty brands while a worker reported both. We set the User-Agent at launch instead.
Our profiles said x86 and the browser said arm
Chrome on an Apple silicon Mac sends Sec-CH-UA-Arch "arm". Our profile records said "x86", read by nothing, so we fixed the record, not the browser.
Why video calls struggle in a proxied profile
WebRTC sends media over UDP, which an HTTP or SOCKS proxy in Chrome does not carry. With non-proxied UDP blocked, only a TURN relay over TCP is left.
BrowserLeaks gives you values, not verdicts
BrowserLeaks prints a canvas signature, a renderer and a JA3 hash, and no pass or fail. Each value means something only beside Chrome on the same machine.
Cloud phones by the minute, and what the meter adds up to
A cloud phone priced per minute and left open eight hours a day runs 14,400 minutes a month. Multiply by the rate before you compare it with a flat plan.
AmIUnique compares you with people who visit AmIUnique
AmIUnique measures its own visitors accurately, and they are not the web. Read which attribute sits at 0.01%, not the headline that says you are unique.
Why Mosaic Pro is one price
Anti-detect browser pricing per profile sells a count. Mosaic Pro is $49 a month for any count, because a profile on your own disk costs us nothing.
The same home IP, sold by several providers
Residential pools overlap: one home device can sit in several sellers' networks at once, so switching seller does not promise switching neighbours.
Sec-CH-UA-Model is empty on a desktop and a phone's name on Android
Chrome on Android freezes the model out of the User-Agent but still sends it in Sec-CH-UA-Model. Our first Android patch sent an empty one.
Testing date and deadline features in another timezone
Midnight cut-offs and "ends today" banners break in zones you don't live in. Test a website in a different timezone without touching your computer's clock.
TikTok Shop Partner Center: managing shops you do not own
TikTok Shop Partner Center lets a seller authorise an agency into their shop and cancel it later. Signing in with the seller's own password skips all of that.
WebRTC and IPv6: the candidate your proxy never carried
A WebRTC IPv6 leak is a candidate gathered over UDP that an IPv4 proxy never sees. Blocking non-proxied UDP closes it for both address families at once.
Why residential proxies cost what they cost per GB
Residential proxies are expensive because every gigabyte crosses somebody's home connection. For a browser profile, count working sessions, not gigabytes.
Accept-CH and Critical-CH: how a server asks for more
Accept-CH asks Chrome for more client hints on the next request; Critical-CH makes it retry the first. A server sees both requests and can compare them.
Testing a site in another language means more than one header
Set Accept-Language alone and the page still formats dates for your own machine. A real language test moves the header, navigator.languages and Intl.
Donut and ShardBrowser: open apps, closed engines
Donut Browser's app is AGPL-3.0 and ShardBrowser's launcher is MIT, but both run a closed Chromium binary. The part a site reads is the part you cannot audit.
Why Cover Your Tracks sends you to firstpartysimulator.org
firstpartysimulator.org is an EFF domain. Cover Your Tracks loads it mid-test as a stand-in first-party site, so a hang there leaves the test running for ever.
What "replace WebRTC IP with proxy IP" can actually mean
A WebRTC public address is what a STUN server saw a packet come from, so it cannot be swapped for the proxy's. What works is gathering no address outside it.
When the residential exit is somebody's infected router
Research has traced residential proxy pools to hijacked servers, paid SDKs and TV boxes sold with proxy code. Residential describes an address, not its source.
Four 504s on one session: rotate, don't retry
On a sticky residential proxy a session token is an exit, so retrying it asks a dead exit three more times. Rotate to a fresh session instead.
TikTok One for agencies: creator access without logins
TikTok One, the old Creator Marketplace, lets an agency run a creator's post as a Spark Ad from its own ad account. The creator approves; no password.
What TikTok's guidelines say about running several accounts
TikTok's guidelines allow more than one account. They rule out accounts that deceive, inflate engagement or return after a ban, and that decides a brand's case.
Following an affiliate link's redirects from three countries
An affiliate tracker picks the landing page from the visitor's IP country. To see a German visitor's page, click from a German exit on German time.
The household behind the exit you are renting
A residential exit is someone's home connection, still in use while you rent it. Whether that is fair depends on how they agreed, and you can ask.
18.28 bits: what Cover Your Tracks' number measures
Bits of identifying information is log2 of how rare your browser is in the EFF's sample. 18.28 bits is about one in 318,000, and it is not a tracking score.
A browser with no RTCPeerConnection doesn't exist
Deleting WebRTC leaves a Chrome no one runs. Zero candidates with the API still present is every machine on a UDP-blocked network, so that is what we ship.
Anti-detect inside your own browser: the extension model
SessionBox keeps a cookie jar per session inside your own browser. Logins stay apart; the GPU, fonts and canvas a page reads are the same in all of them.
getHighEntropyValues: what a page can ask for and what it gets
getHighEntropyValues hands a page architecture, bitness, model and full versions on request, and each answer must match the headers Chrome sends.
Linken Sphere, the other local-first anti-detect browser
With sync off, Linken Sphere keeps a session's cookies and storage on your computer and still sends its metadata. Mosaic has no sync to turn off.
TikTok Shop's multiple-shop rules differ by country
TikTok Shop runs a Seller Center per market, each with its own Seller University. A US answer about multiple shops is a US answer, not a UK one.
A fingerprint that depended on launch order
Chrome's --user-agent flag left Sec-CH-UA-Bitness empty, and a cache empty at every app start decided when we sent it. One profile wore two identities.
Two WebRTC flags we used never existed in Chromium
Chrome has one WebRTC command line flag for leaks: --webrtc-ip-handling-policy. We also sent two that don't exist, and Chromium accepted both in silence.
How far behind Chrome stable is your anti-detect browser?
Real Chrome updates itself, so an engine a few majors old claims a browser almost nobody runs. Our move from 153 to 154 took a 93-minute rebuild.
'Randomized fingerprint' is the wrong goal on Cover Your Tracks
Cover Your Tracks praises a randomized fingerprint, but values that change on every load are a signal too. Profiles need one stable, normal browser each.
fingerprint.com wouldn't load through our proxy, and that was a result
Through one residential exit the FingerprintJS demo hung; from the same Mac with no proxy it loaded. Our runner blamed itself. The exit was why.
A full Chrome version with no build number is one no Chrome shipped
Our engine reported uaFullVersion as "153". Real Chrome always sends four numbers. Sending the full build moved FingerprintJS's confidence to stock's 0.99.
A canvas readback is not a rendering check
Forcing Chrome's colour profile to hdr10 lifted a page's dark background and dimmed its white on macOS. Four checks missed it; a screen capture did not.
Not_A Brand: how Chrome's GREASE brand is computed
The Not A Brand entry in Chrome's user agent is computed from the major version by a fixed formula, so a label that doesn't fit the claimed major is a tell.
Scoring a rotating proxy scores one draw from the pool
A reputation check on a rotating proxy scores whichever exit the pool handed out that second. Pin a sticky session to score the address you will browse from.
Testing whether your affiliate links track, with a clean jar
To test whether an affiliate link tracks, click it from a browser with an empty cookie jar and read what it set. An old click's cookie can spoil the test.
How TikTok decides your Business Center ad account limit
TikTok's Business Center ad account limit is a default set per Business Center type, raised through TikTok. Spend moves a different limit: ad groups.
The .local address in your WebRTC test is Chrome working
A random .local name in a WebRTC leak test is Chrome hiding your LAN address. We once switched it off, and the empty result was the louder tell.
What DNS over HTTPS changes when a browser uses a proxy
Does DNS over HTTPS work with a proxy? Through one, the exit resolves each hostname, so Chrome's DoH setting covers only lookups the browser makes itself.
A FingerprintJS pass has two halves
A FingerprintJS visitor ID should differ per profile and hold across launches of one. Colliding ids link profiles; ids that change flag a spoofer.
Is Camoufox still maintained? Reading the repository
Is Camoufox still maintained? Its repository answers better than forums do: compare the latest release's date and Firefox base with today's Firefox.
queryLocalFonts and the permission that guards your font list
The Local Font Access API permission, local-fonts, guards queryLocalFonts(). Measuring text needs no permission, so the gate binds only polite pages.
Checking what Shopify Markets shows a buyer in each country
To test Shopify Markets geolocation, make the exit, timezone and language name one country: Shopify reads the IP for country and the browser for language.
A blocklist that lists home connections for being home
SORBS answered 127.0.0.10 when an IP sat in a home ISP's range, so a residential proxy got listed for being residential. Read the code first.
Why our reputation check doesn't ask Spamhaus
Spamhaus refuses queries that arrive through public resolvers, so asking it from an ordinary computer returns a confident wrong answer. We left it out instead.
The control that settles "is it our patches?"
Unpatched Chrome for Testing got the same IPHey verdict as our engine, so our patches were not the cause. Its voice list still differs from Chrome's.
Several YouTube channels and one AdSense account
YouTube lets one creator run and monetise several channels, but AdSense allows one account per payee, so every monetised channel you own pays into the same one.
What a YouTube MCN is, and what it can see
What is a YouTube MCN? A network linking channels to its content owner account, collecting their revenue and reading analytics. Strikes stay with YouTube.
A CONNECT to a raw IP means your machine resolved the name
To check if DNS goes through your proxy, read what the proxy is asked for. CONNECT example.com:443 means it resolved the name; a raw IP means you did.
When the FingerprintJS demo can't name your browser
FingerprintJS read 'Chromium-Based Browser Not Available' for our engine. We blamed the version; the real variable was Google's branding.
Same fonts, different measurements: per-profile glyph advances
Font fingerprint randomization can hide fonts or change how wide glyphs measure. Hiding read as masking; per-profile glyph advances did not.
Is a Google DNS server in your leak test a leak?
Google DNS in a leak test is not a leak by itself. It depends on where you browse from: the resolver your own ISP runs is the leak, someone else's is not.
Junglefox and Chroma, Kameleo's two engines
Junglefox is Kameleo's Firefox-based engine, beside Chroma, its Chromium one. A Firefox profile needs an engine that really is Firefox, and keeping one is work.
Pixelscan calls a stock Chrome masked 3 times in 20
A Pixelscan false positive, measured: an untouched Google Chrome read 'Masking detected' on 3 of 20 runs. Our fresh profiles read it once in 74.
Twenty supplier portals, twenty logins, one place for each
Manage supplier portal logins by keeping each one with the store it buys for: one browser profile per store, its supplier logins, codes and notes inside it.
"400 Target website error" and one observation of a pool
A proxy's 400 Target website error usually means the pool gave you an exit that could not reach the site. One answer like that does not make the proxy dead.
Testing your own checkout as a customer who has never visited
To test a Shopify checkout as a customer, pay with a test method from a browser that has never seen your store: no admin login, no saved address, no cart.
A terminated YouTube channel covers the person, not the channel
When YouTube terminates a channel, the ban covers its owner: any other channel they use or create breaks the rules too. The way back is the appeal.
What AudioContext.sampleRate says about your speakers
AudioContext.sampleRate is the rate your output device runs at, usually 44100 or 48000. As a fingerprint it is one bit, and changing it is easy to catch.
Chrome sync quietly joins accounts you meant to keep apart
Chrome sync files everything a profile does under one Google account, whichever account you used in the tab. Two accounts in one profile end up in one history.
--host-resolver-rules: the first match wins
Chrome's --host-resolver-rules tries MAP rules in order and stops at the first match. EXCLUDE is not ordered. A wildcard put first ate our extension's API call.
How websites list your fonts without a font API
Websites detect installed fonts by measuring a test string in each font against a fallback. A width that changes means the font is there. No permission needed.
An account health routine for sellers with more than one store
A seller account health checklist: Amazon, eBay and Etsy grade different metrics over different windows, so read each one weekly, by date, in its own profile.
Mimic, Multilogin's Chromium, and its core numbers
A Mimic core number is the Chrome major it is built on. Set the date a core shipped against the date that Chrome major reached stable, and you have the lag.
Runtime.enable flips a detector, so we don't call it
Runtime.enable detection, measured: one DevTools command turned a clean Mosaic profile into isBot=true on deviceandbrowserinfo. We removed all five calls.
SunBrowser and FlowerBrowser, AdsPower's two engines
SunBrowser is AdsPower's Chromium engine, FlowerBrowser its Firefox one. Choosing Firefox changes the handshake, headers and extensions a profile runs.
Peru, Brazil and Bahrain in three requests
A rotating proxy with no country pin can exit in a different country on every request. Fine for a stateless scrape, fatal to a profile that keeps one timezone.
Why we leave the TLS and HTTP/2 fingerprints alone
A TLS fingerprint mismatch is a User-Agent claiming a browser the handshake did not come from. We avoid it by never claiming a Chrome the engine is not.
Selling on Amazon and eBay at once without crossing the wires
Selling on Amazon and eBay simultaneously is allowed. The wires that cross are your buyer logins, your downloads and the stock count, not the marketplaces.
baseLatency is shared by every profile and moves with your headphones
AudioContext baseLatency and outputLatency come from the real output device, so every browser profile on one computer reports the same pair.
Chrome shuffles its ClientHello, so compare sets
Chrome TLS extension permutation reorders the ClientHello on every connection. Only the extension order moves, so a client that repeats its order is not Chrome.
Why 30% of our profiles use dark mode
The prefers-color-scheme dark mode share in real traffic is far below survey figures. Every profile on our Mac said dark; now each draws dark 30% of the time.
DNS prefetching, the lookup that skips your proxy
Chrome's DNS prefetcher resolves names through your own resolver even with a proxy set. Mapping every name to NOTFOUND makes the leak fail closed.
Sorting the property list hid the question
Property enumeration order is a fingerprint that sorted diffs can't see. Compared unsorted, our engine differed from Chrome only in its 20 field-trial entries.
Separating client work with Google Workspace accounts
Give each person a Google Workspace account and let clients invite that address. Your agency never holds a client's Google password, and leaving ends access.
What Orbita is, from GoLogin's own pages
Orbita is the Chromium-based browser a GoLogin profile opens in. GoLogin says it tracks Chrome releases, and each profile is updated on its own.
A green tick that means the socket opened is worthless
A proxy checker can pass while sites fail, because most test plain HTTP and the browser needs a CONNECT tunnel. Exit and stability are separate answers too.
A proxy that answers HTTP and refuses CONNECT
A proxy that works for HTTP but not HTTPS is refusing CONNECT, the tunnel every HTTPS page needs. A check that fetches a plain-HTTP page cannot see it.
Google Business Profile organization accounts, for agencies
A Google Business Profile organization account lets an agency manage client listings under its own login. The client grants access and keeps ownership.
Why Google says 'verify it's you' on a new device
Google asks you to verify it's you when a sign-in comes without the cookie its last sign-in left, or from an address in a place you have not been.
Same IPHey score, opposite reasons
IPHey Unreliable on a normal Chrome is usually the exit. Our profile and a stock Chrome both got MX 90, for a browser signal and a location signal.
Customer messages across several stores, without missing one
Marketplaces count reply times per seller account, so one unread store inbox costs that store. Keep every store signed in and read all inboxes in one pass.
344 profiles said "denied": one value, everywhere
Notification permission became a fingerprint: Notification.permission read denied on all 344 of our profiles, where an unconfigured Chrome says default.
How the OfflineAudioContext fingerprint is computed
An oscillator through a compressor, rendered silently and summed: the OfflineAudioContext fingerprint reads your machine's floating-point audio path.
"Rotation URL opened" is not "the IP changed"
Mobile proxy change-IP link not working? It worked if it answered 2xx and the exit differs once the modem redials. Our own Proxies page checked neither.
Why Seller Central keeps logging you out
Seller Central signs you out when its cookies go: a cleaned browser, a second store in the same window, a private tab. Keep one store per cookie jar.
socks5 and socks5h: where Chrome resolves the name
In curl, socks5h sends the hostname to the proxy and socks5 resolves it locally. Chrome's socks5 already sends the name; the leak is elsewhere.
Multilogin froze Stealthfox, and what a legacy engine means
Multilogin lists Stealthfox as a legacy core and points users to Mimic. A browser core that stops updating turns its own version into a signal.
A Russian exit and a profile speaking Mexican Spanish
A profile matched to a Russian exit kept sending es-MX in Accept-Language. Leaving the language alone was right. Saying nothing about it was the bug.
A profile in Austria claimed New York
Browser location does not match IP: a no-proxy profile made in Austria claimed New York. One failed lookup was never retried, and a table filled the gap.
An audio spoof that changed the sound every time it was read
getChannelData returns the buffer's own memory, so our audio noise multiplied samples on every read: v·f, then v·f². A seeded byte fixed it.
Grandfathered plans and why review prices disagree
On an old GoLogin pricing plan, your renewal price comes from your own subscription, not the public page. Reviews often quote plans a new account can't buy.
Why IPHey's location card can be greener on a profile than on Chrome
On one US exit in one minute, stock Chrome got IPHey's masked or inconsistent location data and our profile got green. The difference was the timezone.
Merchant Center multi-client accounts for agencies and marketplaces
A Merchant Center multi-client account puts many stores under one operator. Each sub-account is still one store, with a website it can show is its own.
Anti-detect browser promo codes and the price at month thirteen
An anti-detect browser promo code usually discounts one payment. Compare what you pay in month thirteen, at the profile count you will have by then.
Elite, anonymous, transparent: proxy levels mean little on HTTPS
Elite vs anonymous proxy is about X-Forwarded-For and Via on plain HTTP. Inside a CONNECT tunnel to an HTTPS site, a proxy cannot add a header at all.
A seller's morning across six stores, one profile each
An ecommerce seller's daily checklist: messages, orders, account health. With six stores, open all six signed in at once instead of signing in and out.
What your proxy provider can and cannot see
Over HTTPS a proxy provider sees each hostname, port, time and byte count, never the pages or passwords. Over plain HTTP it sees everything you send.
A spoof that answers once: the geolocation bug we shipped
A geolocation spoofing timeout we shipped: the first getCurrentPosition got the exit's coordinates, every later call failed with code 3. One latch was to blame.
How many Google Ads accounts one person can make
Google caps Google Ads accounts per login, counts manager accounts in that cap, and sends anyone advertising for several businesses to a manager account.
IPHey's score moves on unmodified Chrome. Read the card.
A low IPHey MX score is the sum of five cards. Untouched Chrome scored 100, 100, 70 and 0 in one afternoon, so the red card tells you more than the number.
IPHey's "(whale)" signal, and what it was really about
IPHey's inconsistent browser fingerprint (whale) looked like a version problem. We followed it through branding and JavaScript to a Widevine certificate.
Unlimited local profiles, metered cloud ones
A local profile is a folder on your disk and costs the vendor nothing; a cloud one is storage and transfer on every open. That is why only cloud gets counted.
Pin the country, not the address
A residential pool moves your exit whatever you do. The checks that matter compare countries, so pin the country and let the address move inside it.
Our proxy relay told the gateway it was a script
Chrome sends Proxy-Connection: keep-alive, lower case, to every proxy. Our relay sent Keep-Alive, no User-Agent and Connection: close, until we copied Chrome.
Giving a virtual assistant access without handing over the password
Seller Central, Meta and Google each let you add a virtual assistant under their own login, with chosen permissions. A shared password is the fallback.
Every profile on one Mac drew the same WebGL image
A WebGL fingerprint is the same in every browser profile on one machine because the GPU draws it. Ours was too, until per-profile noise moved the hash.
What navigator.gpu.requestAdapter tells a page without asking
WebGPU's adapter info gives any page the GPU vendor and architecture with no prompt. A WebGL renderer that says otherwise is a contradiction, not a disguise.
What ANGLE means in your WebGL renderer string
ANGLE is the layer Chrome uses to turn WebGL into Direct3D, Metal or OpenGL. The backend it names in the renderer string tells a site your operating system.
Running 49 fingerprint tests unattended, and what that takes
To automate browser fingerprint testing, tell a failed profile from a dead site, an unreadable page and your own bug. Our runner names each across 49 rows.
Header order is a fingerprint, and a tunnel cannot touch it
Sites read the order of Chrome's HTTP headers as well as their values. Through a CONNECT tunnel a relay carries ciphertext, so it cannot reorder a thing.
Profile creation caps, the meter missing from the headline
A profile creation limit counts every profile you make, deleted ones included. It exists because delete-and-recreate gets round a profile cap.
What Google Ads advertiser verification asks, and what it joins
Google Ads advertiser verification requirements: a legal name, a country and documents for who pays and who advertises. Every account under that name is one.
Partnership ads let a brand run a creator's post without the password
Instagram partnership ads access is a permission the creator grants from their own account. The brand runs the ad; nobody sends anybody a password.
IPHey's score moved with the address, not the browser
IPHey score changes even on an untouched Chrome: 100, 100, 70 and 0 in one afternoon. The score follows the exit and the moment; the browser card does not.
The residential IP several detectors already knew
A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds.
What breaks in the browser between three clients and thirty
Scaling social media agency operations breaks the browser first: Chrome profiles hold three clients, but thirty needs an exit, 2FA and bulk edits per client.
Twenty APIs Chrome doesn't have: Chromium's field trials
Unbranded Chromium runs its field-trial testing config at every launch. Against Chrome 153 that was 20 API differences, and one switch moved them all.
Anti-detect plans that bundle proxy traffic
When an anti-detect browser plan includes proxy traffic, it is usually a few gigabytes: a sample. What keeps profiles apart is one session per profile.
Chrome opens connections before your test starts
We counted 1, 0 and 0 CONNECTs in three launches and thought Chrome was bypassing the proxy for HTTPS. Our counter was reset after Chrome had started.
What happens to QUIC when Chrome has a proxy
With an HTTP, HTTPS or SOCKS5 proxy set, Chrome reaches sites over TCP tunnels, so a page that gets HTTP/3 direct gets HTTP/2 through the proxy.
Why we change fingerprints in C++, not JavaScript
A JavaScript spoof is one realm deep. An iframe read the real source of 33 of our patched functions; the same values changed in C++ agree everywhere.
41 of 45 hand-written Windows renderer strings were wrong
Chrome's ANGLE Direct3D11 renderer string carries the GPU's PCI device id. Our hand-typed Windows rows left it out, a string no real driver produces.
We broke the timezone on purpose and Pixelscan liked it better
We changed only the timezone on one profile behind a Slovak exit. Pixelscan flagged masking on the Vienna row, the correct one, and the controls disagreed.
A quarterly check of who can reach each client account
A social media account access audit is two lists per client: who the platform says has access, and which of your profiles hold a login. Each gap is a finding.
Share the dataset, not the login: Meta's partner model
To share a Facebook pixel with an agency, the client adds the agency's business portfolio as a partner on the dataset. No password moves hands.
IPv4 from one probe, IPv6 from the other: one exit, not two
A proxy that shows an IPv4 address on one checker and an IPv6 address on another is usually one dual-stack exit. Rotation only shows within one family.
Posting to the wrong client's account, and how it happens
A post lands on the wrong client's account because two clients share one browser and every window looks the same. Delete it, tell both, then label windows.
Name the browser profile the way you name the ad account
Our naming convention for client ad accounts: ACME-DE-EUR, code first, since a cut-off name keeps its start. The browser profile is ACME-FB-Ads.
The Akamai HTTP/2 fingerprint, read field by field
The Akamai HTTP/2 fingerprint is four fields: the SETTINGS values, the window update, any priority frames and pseudo-header order, all read before content.
Why free anti-detect plans are often cloud-only
A free anti-detect browser with cloud profiles only keeps your first sign-ins as cookies on the vendor's servers. A cookie jar is a credential.
ERR_PROXY_CONNECTION_FAILED is about the first hop
Chrome's proxy connection failed error means it never reached the proxy address it was given. Check the host, the port and anything local before the exit.
Same proxy session on multiple profiles: forty profiles, forty exits
The same proxy session on multiple profiles means one exit IP for all of them. A batch of ours did it in September 2026; now every profile mints its own.
What Meta business verification connects to your business
Meta business verification documents tie a business portfolio to one legal name, address, phone and domain. Two portfolios verified that way are one business.
Pixelscan's automated behavior card, reproduced and not
Pixelscan's automated behavior detected card never came back on our own platform beside stock Chrome. The foreign platform claim failed four times in four.
Pixelscan reads sixty WebGL fields, and the renderer string is one
Pixelscan's WebGL fingerprint is a render hash plus about sixty driver fields beside the renderer string. A chip that never existed failed like a real one.
What happens to your profiles when the subscription ends
When an anti-detect browser subscription expires, where profiles live decides the cost: a cloud vendor holds your cookie jars; a local app leaves them on disk.
A WebGL renderer string is a claim and the limits are the evidence
WebGL MAX parameters, shader precision formats and the extension list come from the real driver. Our engine moves them only with data from a real device.
Comparing two TLS handshakes: compare the set, not the order
To compare two TLS fingerprints, label GREASE and compare the extension set sorted. Our first diff against Chrome showed two differences, both noise.
What ERR_TUNNEL_CONNECTION_FAILED is telling you
Chrome's tunnel connection failed error means the proxy refused the CONNECT tunnel. In our runs the usual cause was a sticky session the gateway had retired.
Pixelscan's masking verdict, bisected to one surface
We bisected Pixelscan's masking detected verdict on one profile. Canvas, WebGL, audio and client rects were fine. Hiding about 2% of font families caused it.
When Pixelscan never stops scanning
Pixelscan stuck on scanning for 90 seconds was, in our runs, a profile claiming Windows on a Mac. A scan that never returns is a non-verdict, not a slow pass.
What a second seat costs across anti-detect browsers
Anti-detect browsers meter people as well as profiles. A seat is a login to the vendor's shared library; Mosaic has no teams, so it has no seats.
The shared password spreadsheet, and what replaces it
A spreadsheet of client logins breaks two-factor sign-in and leaves nothing to revoke. Partner access first, then one vault per login with its code.
What an expiring sticky session looks like from inside a browser
A sticky session expired on our proxy: the browser showed tunnel errors, the check a healthy proxy in another state. Neither said expired.
UNMASKED_RENDERER is null until a page asks for it
Chrome returns null for the unmasked WebGL renderer until the page calls getExtension, so a spoof that answers it earlier is a two-line tell.
Who owns a Facebook Page an agency built for a client
The business portfolio that created or claimed a Facebook Page owns it, whoever paid for the work. The client creates; the agency is added as a partner.
Widevine device certificate privacy: one key for every profile
Widevine device certificate privacy needs a Google-signed browser. Without it, the first licence message is 1704 bytes where Chrome sends 2.
Yearly discounts on anti-detect browsers, read in full
At 40% off, a prepaid year costs what 7.2 months of monthly billing would. It is also a bet that the engine keeps up with Chrome for twelve months.
199 voices: how a speech list tells Chromium from Chrome
speechSynthesis.getVoices() lists 199 voices in Google Chrome on our Mac and 180 in any unbranded Chromium. A page reads the difference in one call.
The CreepJS proxy test is not about your proxy
CreepJS's proxy page looks for JavaScript Proxy objects wrapped around native functions. A flag there names a spoofing script, not your IP address.
Facebook's additional profiles: a second profile Meta built itself
Facebook additional profiles rules, as Meta designed them: one account, one login, and a violation on any profile counts against the whole account.
Facebook's real name policy, and what it allows instead
Facebook's real name policy asks for one personal account per person, under the name you go by. Pages and business portfolios are how you run more.
Naming 300 browser profiles so you can still find one
Name each profile client code, platform, role, in that order, so one search finds a client and one sort groups them. Status goes in a tag, not the name.
Projects say who owns it, tags say what state it's in
How to organize client accounts with tags: the client goes in a project, the state in a tag. Owners rarely change; states change weekly.
Reading a browser's ClientHello with a one-minute listener
A raw TCP listener that reads the first TLS record and hangs up captures a browser's ClientHello. Ours and branded Chrome's matched in every field.
The setting was saved, and three launches ignored it
Our rotation setting was stored, reported back by the API, and ignored by three launches. A mapper had copied every field of the proxy except the new one.
readPixels and toDataURL read a canvas from opposite ends
readPixels starts at the bottom row and toDataURL at the top, so position-keyed WebGL noise disagreed with itself. Keyed on colour, 4096 of 4096 pixels agree.
Why OS spoofing fails on fonts: a Mac makes Mac profiles
Why OS spoofing fails on fonts: they come from the computer, not the claim. A Linux profile made on our Mac showed 1 font where macOS showed 159.
Why canvas blocker extensions can make you easier to spot
A canvas blocker extension hides your canvas fingerprint by rewriting methods in page JavaScript, and a fresh iframe reads the rewrite: 33 leaked on one probe.
The first hour in the browser with a new client
A social media client onboarding checklist for the browser: ask for partner access, not passwords, then a project, a proxy in their market and their 2FA.
Paying per open browser instead of per profile
Concurrent-browser pricing charges for how many profiles are open at once, not how many exist. Cheap for a big quiet library, costly when many run together.
What CreepJS's prototype page tells you about JavaScript spoofing
CreepJS's prototype page checks each native function's keys, source and errors. A value patched in JavaScript trips it; a value changed in C++ leaves nothing.
JA4 moves with the Chrome major, and that is not a tell
Chrome 152 read t13d1517h2 and 153 read t13d1518h2: one TLS extension apart. Compare a JA4 only against a Chrome of the same major version.
Accounts Center is a link Meta asks you to make yourself
Accounts Center joins your Instagram, Facebook and Messenger accounts: one login, shared contact details, payments and ad settings. Meta reads it as one person.
Why our engine has no TLS fingerprint setting
You can't change Chrome's TLS fingerprint from a setting, and we chose not to patch it: our engine's JA4 matched Google's own build byte for byte.
Anti-detect browser daily launch limits and per-launch fees
An anti-detect browser daily launch limit meters use, not size: at 500 profiles and 30 launches a day, each profile opens once every 17 days.
The port number told us whether a proxy was SOCKS5
Nothing in host:port:user:pass says HTTP or SOCKS5, and curl assumes HTTP. At CatProxies we asked the port: 11000 answered SOCKS5, 10000 HTTP.
Business Manager is now a business portfolio. What changed
Meta renamed Business Manager to business portfolio and moved nothing. An ad account still belongs to the portfolio it was made in, so check whose that is.
The four-line probe that catches position-keyed canvas noise
To detect canvas noise injection, draw one shape twice at two offsets and diff them. A real browser gives 0 bytes; our old noise gave 76.
What to do with a client's browser profile when the contract ends
Agency client offboarding goes wrong when access is revoked before the client can sign in. Confirm the handover, export, then trash the profile by id.
Introducing Mosaic, an anti-detect browser that lives on your machine
Mosaic runs its own Chromium, draws each profile from a real machine and matches it to the proxy exit. Profiles stay on disk. One plan, no per-profile fees.
A session token on a rotating port is a 400, not a no-op
"Can not use -session- on rotating ports" means the port, not the username, decides stickiness. We had written the opposite, until we asked the gateway.
The canvas method nobody noised: what a worker test found
Our canvas noise reached toDataURL and missed toBlob, so a page calling toBlob got a PNG byte-identical to stock Chrome's. A worker test caught it.
What a canvas hash actually tells a site about your machine
A canvas fingerprint reveals your rendering stack: GPU, driver, fonts, the OS's text rasteriser and antialiasing. It names a kind of machine, not a person.
What a CreepJS lie is, and why stock Chrome has none
CreepJS lies detected means an API behaved unlike the native one: wrong toString, wrong descriptor, or a worker that disagrees. Stock Chrome has none.
Why anti-detect browsers cost what they cost
Anti-detect browsers are expensive per profile when the vendor stores and syncs each one. A profile on your own disk costs the vendor nothing.
Why Chrome's JA3 hash changes on every connection
Chrome's JA3 changes because Chrome shuffles its TLS extension order on every connection, and JA3 hashes that order. JA4 sorts first and holds still.
Nothing here yet. The first one is coming soon.
Every account its own browser. One price for all of them.
Free holds 3 profiles and 10 profile creations, with no card. Pro is $49 a month for any number, or $490 a year with 2 months free. Try it for 14 days; cancel before day 14 and you pay nothing.