On a warehouse shelf somewhere, two hundred mid-range Android phones sit plugged into the same USB hub, running the same app, each pretending to be a different person. The hardware is real. The SIM cards are real. The users are not.
That's a device farm, and it's behind most of the signup fraud, promo abuse, and inflated engagement we've investigated at Phylaxa. If your detection logic still assumes a real device means a real user, this piece is about why that assumption breaks and what to measure instead.
What a device farm actually is
The label covers three setups that get conflated:
- Phone walls. Racks of physical phones bought in bulk, rooted, and factory-reset between jobs. One operator, hundreds of devices.
- Cloud phones. Android instances running on ARM servers in a datacenter, rented by the hour. The "screen" is a video stream into a browser tab. Scaling to another thousand devices is a billing decision, not a shopping trip.
- Group control. The software layer tying the other two together. One script broadcasts taps, swipes, and typed text to every device at once, turning a wall of phones into a single pair of very fast hands.
What separates farms from emulators is exactly what makes them annoying to catch. An emulator fakes the hardware, so you can catch it: QEMU strings in the build fingerprint, navigator.webdriver === true, a gyroscope that doesn't exist. A phone wall passes every one of those checks, because the checks answer the question "is this a real phone?" and the honest answer is yes.
It's the wrong question.
The supply chain, priced per account
What farms sell, roughly in order of volume:
- Promo abuse. Welcome bonuses, referral credits, coupons, first-order discounts. One farm claims the same offer thousands of times.
- Bulk account registration. Buyers order accounts like office supplies: ten thousand verified signups, delivered as a spreadsheet. Prices we see quoted on gray-market channels run from a few cents to a few dimes per account, phone verification included.
- Engagement inflation. Followers, likes, app installs, five-star reviews for hire, one-star reviews aimed at a competitor.
- SMS code rental. The enabling layer under everything else. A number rented for sixty seconds, the verification code scraped automatically. Cost per code: cents.
Do the attacker's math once and the motivation is obvious. If your signup incentive is worth $5 and a verified fake registration costs $0.10, the farm breaks even at a 2% cash-out rate. Imperva's Bad Bot Report has put bad-bot traffic at roughly a third of the web for years, and fraud operators are a meaningful slice of that. Device farms are their infrastructure.
The signals that still work
No single signal below is a verdict. Farms patch individual holes quickly; what they can't patch cheaply is the joint picture.
1. Device attestation, with caveats. Play Integrity on Android and App Attest on iOS give you a device verdict signed by Google or Apple. Useful, but overrated as a standalone defense: clean farm devices pass basic integrity checks, rooted ones get wrapped in hook frameworks built to game the verdict, and your web channel gets nothing at all. We've made this mistake ourselves. We leaned on attestation too hard and watched one cloud-phone provider sail through for weeks.
2. Sensor reality. A phone in someone's hand never sits still. The accelerometer and gyroscope show constant micro-noise, the light sensor tracks the room, the screen angle drifts. A phone zip-tied to a rack reports flat lines for weeks. Battery state is just as loud:
const battery = await navigator.getBattery();
const racked =
battery.charging && battery.level === 1 && battery.dischargingTime === Infinity;
// 100% charged, on AC power, forever. Humans unplug their phones.
That API is Chromium-only, but a large share of farm web traffic runs through Chromium-based clients anyway, so it earns its keep.
3. Cluster fingerprints. One Xiaomi Redmi on a residential IP in Manila is a user. Four hundred Redmis on the same OS build, same screen resolution, same carrier, same subnet, all factory-reset inside the same week, is a farm. Every fact alone is explainable. The joint distribution isn't.
4. Behavioral synchrony. Group control sends the same gesture to every device at the same moment. Operators add random jitter, but cross-account timing correlation survives: hundreds of sessions tap the same coordinates in the same order with an alignment that doesn't happen in nature. This is the signal we trust most, and it's the same session-level behavioral analysis we described in our piece on detecting LLM scrapers.
Real device, fake person
The farm industry's pitch to fraud buyers is "real devices pass real-device checks." They're right, and that's why device checks alone lost. The fix is to stop scoring devices and start scoring sessions: what did this session do, in what order, at what pace, with what input dynamics, and how does that compare to the humans you already have?
At Phylaxa we collect 300+ passive signals per session, device, network, and behavior combined, and score the whole sequence with a fine-tuned LLM at the edge in under 5 ms. A rack phone with perfect hardware, a dead gyroscope, a flat battery curve, and forty sibling devices on the same subnet doesn't need to be proven fake. It just needs to score like what it is. Real users never see a challenge.
If farm traffic is inflating your signup numbers, the math in the real cost of bot traffic will look familiar. For a limited time, Phylaxa is free for teams under 100,000 monthly active users; see pricing.