Incogniton Detection

How to detect Incogniton in 2026

Incogniton is the budget entrance to antidetect browsing: a permanent free plan, cheap paid tiers, and enough tooling — profile sync, team sharing, automation hooks — to run a small account farm from day one. Low cost means high volume and less careful operators, which shapes how its sessions show up in Sentinel's signals.

What Incogniton is

Incogniton advertises a Chromium-based antidetect browser with a free plan of ten profiles — unusually generous for the category — and paid tiers that add profile capacity, cloud sync, and team member access. Profiles can be created in bulk from spreadsheets, driven programmatically through Selenium and Puppeteer integration on higher plans, and it even ships a "paste as human typing" feature that replays clipboard text with keystroke timing. The pitch is managing many browser identities cheaply, with the automation to match.

The signals Incogniton sessions run into

Sentinel applies the same layered evaluation to a ten-dollar tool as to a thousand-dollar one: is the claimed device internally consistent, is a script driving it, does the network origin fit, and has this machine been here before? Budget operations tend to fail several of those at once.

Antidetect-browser flag

A Chromium rebuilt so its fingerprint surface is user-configurable carries recognisable traits of the antidetect category. Sentinel reports them as device.antidetect with the antidetect_browser reason code.

Tampering score

device.tampering_score condenses fingerprint manipulation into a 0–1 value — above 0.6 is strong evidence of an antidetect browser, 0.3–0.6 marks milder anomalies. Bulk-generated budget profiles are exactly where careless engine-vs-claim contradictions accumulate.

Engine/OS mismatches

A spreadsheet-generated profile might claim an OS, browser version, and hardware combination that the engine underneath visibly doesn't match. Those cross-checks are what feed the tampering score.

Automation hooks

Selenium- and Puppeteer-driven Incogniton profiles — and simulated-typing shortcuts — are machine behaviour, and machine behaviour is what device.automation flags (reason: automation_detected). VM-hosted seats additionally trip device.virtual_machine or device.emulator.

The proxy layer flags anyway

Cheaper operations often mean cheaper exits — rotating proxy pools, consumer VPNs. Sentinel's Spur-powered network layer classifies the IP independently, so even a clean-looking profile inherits its network's reputation.

Reuse leaves a trail

Ten free profiles on one machine still means one machine. device.times_seen counts its visits, and accountId-based linking surfaces linked_accounts > 1 — the multi_account tell that free-tier farms can't avoid.

Keeping it honest: "easier to catch" never means "always caught." A carefully configured Incogniton session on a good residential exit can pass any single check — every vendor's, including ours. What it struggles to do is pass all of them, repeatedly, while reusing hardware and accounts. Sentinel gives you the individual signals and a 0–100 risk score; your own rules and thresholds turn them into block, review, or allow.

From signup to verdict

Load the Sentinel SDK on the pages fraudsters target, then call /v1/evaluate from your server and branch on device.antidetect, device.tampering_score, and the reasons array. The API reference has the complete schema; the antidetect deep-dive covers the how and why. For the tool-specific breakdown, see Incogniton playbook: field notes for working fraud teams.

Free-tier farms are loud. Start listening.
Free tier: 1,000 requests/hour. No credit card, no expiry. Free during open beta.

Start free — no card Try the live scanner