What a Device Farm Is
A device farm, in the fraud sense, is a room or rack full of real phones used to generate installs and engagement that look like they came from real people. Operators click on tracking links, install the app, open it, and sometimes complete registration or a small purchase, then reset the device and repeat. Because the phones are real, the installs pass checks that would catch fully simulated traffic.
The same term has an honest meaning in app development. Testing services run apps on hundreds of real devices to catch crashes and layout bugs. That kind of device farm never touches your ad campaigns. This entry is about the fraudulent kind.
How Install Farms Operate
Farms are built around resets. Every time a device installs the app, the operator wants it to look like a brand-new user, so they reset the advertising ID, clear app data, reinstall, and sometimes change the device name or language. Traffic is routed through VPNs, residential proxies or rotating mobile connections so installs do not all share one IP.
Some farms are fully automated, with scripts that tap through onboarding. Others use people working in shifts, which makes the behavior less uniform and harder to separate from real users. Either way, the farm's goal is to clear the bar the advertiser pays for, whether that is an install, a registration or a first deposit, and then stop.
Signals That Expose Device Farms
Farms leave patterns because they reuse hardware and networks. Watch for clusters of installs from the same IP address or subnet, especially within short time spans. Look at device distribution: a source dominated by a narrow set of models and OS versions, unlike your normal mix, is suspicious.
Timing helps. Installs that arrive at regular intervals, or event sequences that repeat in the same order with the same gaps, suggest scripts. So does a sharp drop-off right after the payout event: users who register and never return, across a whole source, are not users.
Retention and revenue are the final check. Compare each source's day-one and day-seven retention, event depth and revenue per install against your baseline. Farms can fake the first session but rarely sustain a second week.
Defending Against Device Farms
No single rule catches every farm, so layer the defences. Rules on IP concentration, such as many installs from one IP in a short window, catch the cheapest farms. Device-level rules catch hardware reuse, such as many installs tied to the same device signals despite new advertising IDs. Behavioral rules catch the rest, by flagging sources whose post-install activity does not match real users.
Linkrunner's Fraud Control includes click flooding rules by IP and by device, installs from fraudulent clicks, and data-center IP lists maintained by the engine. You can write your own rules in plain English, preview their impact on past installs, and tag matching installs or withhold their postbacks so ad networks do not optimise toward farm traffic. Flagged installs stay in your totals for review. See fraud protection.
Working With Partners
Device farm traffic usually enters through a specific sub-publisher or affiliate. Ask networks for sub-publisher IDs on every click, so you can see which source is responsible and ask for it to be removed rather than pausing a whole network. Share the evidence: IP clusters, device patterns and retention curves are hard to argue with.
Payment terms help too. Paying on events that happen later, such as day-seven activity or a verified purchase, raises the cost of farming. Combined with quality reviews before payouts are finalised, it makes your campaigns less attractive targets.
Reading the Evidence
When you suspect a farm, build a simple evidence pack before acting. Pull the source's installs for the period, group them by IP address and subnet, and count installs per group. Real traffic spreads across many networks; farm traffic stacks up on a few. Then group by device model and OS version and compare with your organic mix. A farm's hardware rarely matches your real audience.
Next, line up the timing. Plot installs by minute of the day. Farms working in shifts or on scripts produce regular rhythms, bursts at fixed times or steady intervals that real users do not. Finally, plot retention for the source next to your baseline. A cliff right after the payout event, followed by almost nothing, is the clearest sign of all.
This pack is useful twice. It justifies the rule you turn on, and it gives the partner something concrete to act on. Networks respond faster to IP clusters and retention curves than to a general complaint about quality.