1. A method for distinguishing a compromised client device from a masquerading device, the method comprising: capturing, by a hardware processor of one or more servers, a plurality of attributes from a network device connecting to a web service, each of the attributes representing a parameter, the plurality of parameters uniquely identifying the network device from a plurality of other networks devices; maintaining the network device free from any software programs associated with the capturing of the plurality of attributes; determining, by the hardware processor, a device identifier based on a programmatic transformation of the plurality of attributes captured from the network device; comparing, by the hardware processor, the device identifier against at least one existing device identifier determined by the hardware processor, wherein the at least one existing device identifier is generated based on a programmatic transformation of a plurality of attributes captured from a respective device; and determining, by the hardware processor, if the network device is compromised based at least in part the comparison between the device identifier and an existing device identifier.