35+ server-side signals surface VPNs, incognito mode, anti-detect builds, browser tampering, and privacy browsers — each returned on its own field, alongside a weighted risk score from 0 to 100.
Detect Safari private browsing on iOS today; general cross-browser incognito detection for Chrome, Firefox, and Edge is in active development.
Spot UA spoofing, canvas blocking, WebGL manipulation, and prototype-chain tampering in one pass. 4.4% of desktop sessions now show tampering.
Score how likely a session runs in an anti-detect build, from universal spoofing markers rather than a list of product names.
Recognize Brave, Tor Browser, Firefox with Enhanced Tracking Protection, and other privacy-hardened browsers.
Surface when the browser dev tools panel is open or was recently used during a session.
A weighted risk score on every identification, plus a suspect score that appears once automation evidence crosses the detection threshold.
Our lightweight SDK collects 300+ browser signals asynchronously, with zero impact on user experience.
Server-side engine analyzes signals, runs weighted similarity matching, and computes confidence scores.
Get a stable visitor ID, bot detection results, smart signals, and IP intelligence in a single API response.
A few lines of code, one API response with everything you need.
// Smart Signals arrive on your server in the webhook eventapp.post('/webhook/tracio', (req, res) => { const event = req.body console.log(event.network.vpn) // true console.log(event.decision.riskScore) // 42 (0-100) console.log(event.decision.suspectScore) // 55 (0-100) res.status(200).send('OK')})We infer Safari private browsing on iOS today using filesystem API quota differences and IndexedDB behavior variations between normal and private sessions. General cross-browser incognito detection for Chrome, Firefox, and Edge is in active development — do not rely on a general incognito flag for those browsers yet. Where a signal is available, we use redundant techniques so detection stays resilient as browsers patch individual vectors.
The Smart Signals tampering module flags browsers whose properties have been modified from genuine values. It cross-validates navigator.platform against UA claims, verifies WebGL renderer strings against expected GPU models, checks CSS media queries against reported screen dimensions, and detects API overrides via proxy objects. Browser tampering now affects 4.4% of desktop identifications — nearly doubling year-over-year.
Anti-detect builds leave subtle but measurable traces that a genuine browser never produces. Smart Signals looks for injected fingerprint-spoofing globals and CSS variables, WebGL renderer strings that contradict the reported hardware, and API answers no physical device gives — then returns an antidetect score from 0 to 100, without depending on a list of product names.
Two numbers travel with every decision and answer different questions. The risk score is the composite: bot probability carries the largest single weight, and server-side evidence adds to it — a TLS fingerprint that betrays automation, a spoofed header order, a TLS-to-user-agent or TLS-to-OS mismatch, and a country that contradicts the IP geolocation. The network cluster contributes the strongest signal that fired rather than the sum, so proxy, VPN, Tor, and datacenter can never count one address twice. The suspect score is narrower: it is the bot score itself on the same 0–100 scale, and it appears only once automation evidence crosses the detection threshold — its absence is not a statement that risk is low. Incognito mode and privacy-browser detection are reported on their own fields; neither is a term in the risk score.
1 in 5 visitors uses a VPN in 2025. On Chromium desktop, 1 in 3 does. Hidden traffic is the new normal.
Fingerprint Device Intelligence Report, 2026
See how teams use Smart Signals to solve real-world problems.
Detect incognito mode, VPNs, and browser tampering during login attempts.
Learn moreScore transaction risk using 35+ server-side signals before processing payment.
Learn moreProtect premium content from unauthorized access, automated scraping, and sharing.
Learn more3 lines of code and 5 minutes to integrate. First signals on your real traffic in your next API call.
14-day free trial · Full platform access · 5-minute integration