Device farm

Where an emulator farm simulates phones in software, a device farm uses real hardware: shelves of cheap smartphones or streaming boxes, wired up and operated by scripts or by a handful of people. Because the devices are genuine, many basic device checks pass.

Device farms install apps, watch ads, click, register accounts and generate in-app events. To make a few hundred phones look like hundreds of thousands of new users, they repeatedly reset advertising IDs, clear app data and reinstall. This "device ID reset fraud" is a core install fraud technique, and farms may pair it with VPNs or proxies to change apparent location.

Signals include many new device IDs from the same small set of IPs or Wi-Fi networks, the same hardware models and OS builds in clusters, very high install-to-uninstall churn, activity at machine-regular intervals, devices with almost no other apps and new users who never return. MMPs also track device-level signals that survive an ad-ID reset. Device farm activity is SIVT; when real people are operating the phones by hand it overlaps with a click farm.

Think of it like this

A device farm is like one person with a wardrobe of wigs and fake moustaches going through a turnstile over and over, counted as a new visitor each time.

An example

An e-commerce app in Vietnam receives 50,000 installs from one source in a month, but they map to just 600 hardware fingerprints, each resetting its ad ID roughly 80 times.