A device farm is a collection of physical or emulated devices used to create fake accounts at scale. An emulator ring achieves the same result in software, simulating many clean phones or browsers on one host with no hardware at all. Professional rings do not rely on one phone and a list of stolen identities; they run dozens, sometimes hundreds, of these devices from a single machine, draining bonus pools before an operator’s fraud queue catches up.
This guide is for fraud analysts who are already familiar with device farms and are interested in the specific signals, rules and operational moves that help catch them before they can scale.
quick summary
What Are Device Farms and Emulator Rings?
A device farm is a setup in which multiple physical devices (phones, tablets or desktops, racked together) are used to create and operate fake accounts in bulk. Each device registers a new account, often with a fresh SIM card or a disposable email address, so the accounts appear unrelated at the identity layer. The operation looks manual from the outside: real hardware, real screen taps, but underneath, it’s industrialized.
An emulator ring skips the hardware. Emulators and virtual machines simulate mobile or desktop environments in software, allowing a single operator to spin up dozens of virtual devices on a single host. Each virtual instance presents a different device profile to the target platform while sharing the same underlying machine.
The economics favor the emulator ring. There is no hardware to buy and no ceiling on how many instances run at once. The two approaches leave different traces, which is why detection has to cover both.
Why iGaming Is a Prime Target
The economics make mass-produced fake accounts profitable in ways that most other industries do not match. Welcome bonuses, free-bet offers and sign-up credits give every new account immediate extractable value. Multiply a $25 welcome bonus across 200 emulated accounts, and the ring pulls $5,000 before a single account gets flagged.
CPA-per-FTD affiliate models compound the problem. When an affiliate earns a fixed fee for every first-time depositor they refer, and those fees can reach hundreds of dollars, a farm generating fake FTDs bleeds the acquisition budget while also draining the bonus pool. The affiliate collects the payout, the accounts collect the bonuses and the operator absorbs both losses.
Multi-accounting is the mechanism that ties these incentives together. One ring creates hundreds of accounts, each appearing to be a unique player, to harvest every bonus and referral reward on offer.
How Professional Rings Operate
Understanding the adversary makes the detection land. Three categories cover the tools fraud rings actually use:
Emulators and virtual machines
An emulator mimics a mobile device in software. A virtual machine does the same for desktop environments. Both allow a single physical machine to present itself as many separate devices, each with its own operating system instance and identity.
The appeal is volume without cost. Spinning up a new emulated device takes seconds. Because each instance can be configured with different screen resolutions, OS versions and locale settings, the accounts created from them look superficially distinct. The weakness is that emulators and VMs leave detectable artifacts in the device configuration they report, artifacts that real hardware doesn’t produce.
Anti-detect and clone browsers
Anti-detect browsers exist specifically to defeat device fingerprinting. They randomize or spoof the parameters that fingerprinting collects so that each session presents what appears to be a unique device.
Clone apps serve a parallel purpose on mobile. They let a user run multiple instances of the same app on a single phone, each with its own isolated data container so that a single device can hold several apparently separate accounts simultaneously. The device is real, but the identities are manufactured.
Reused and spoofed device IDs
Even with spoofing tools, the same hardware keeps surfacing. A device that creates 40 accounts over a week may rotate its browser fingerprint each time. Still, low-level hardware identifiers, such as GPU renderer strings, audio stack characteristics and battery API behavior, resist convincing masking.
At scale, this produces clusters, meaning groups of accounts whose device profiles are not identical but share enough deep parameters to point back to one physical or virtual host. Those clusters are what detection acts on.
“In one real ring, a fraudster created roughly 14,000 accounts, each with a new IP, device, phone number and email, but reused the same password every time. The matching password hash linked the accounts and exposed the whole farm by the third signup.”
Daniel Sebes, VP & GM, Betting and Gaming
How to Detect a Device Farm or Emulator Ring
Each method below is a discrete detection signal that an analyst can apply. None is conclusive on its own, and they range from the highest confidence to those that work best in combination.
Flag Emulators and Virtual Machines Outright
Emulator and VM detection is the clearest signal available. Real players do not register from emulated Android instances or Hyper-V virtual machines, so the false-positive rate on legitimate users stays close to zero.
Detection works because emulators and VMs expose artifacts that real devices do not: specific hardware model strings tied to known emulator frameworks, missing sensor data (such as an absent accelerometer or gyroscope), virtualized GPU renderers and system properties that indicate an emulated environment. A device fingerprinting engine that checks for these markers can flag the session before the registration form is submitted.
Spot Reused and Highly Similar Device Fingerprints
When a fraud ring rotates identities, the device associated with the identity changes more slowly than the email address does. Fingerprinting that collects 200+ parameters builds a persistent profile that’s difficult to spoof completely across every dimension at once.
Watch for multiple accounts arriving within a short window whose fingerprints are identical or share an unusually high number of matching parameters. Five accounts from five different email addresses, all reporting the same GPU renderer string, the same canvas hash and the same installed font list, are not five different people.
Near-matches matter as much as exact matches. A sophisticated ring might randomize a few surface parameters while leaving deeper hardware attributes untouched. Scoring fingerprint similarity across a spectrum captures the rings that pass a simple duplicate check.
“When five ‘different’ users arrive from the same affiliate and share the same device fingerprint, it’s either a device farm or a single person cycling through identities”
Daniel Sebes, VP & GM, Betting and Gaming
Link Accounts by Shared Device, Browser and Cookie Hash
Device farms produce accounts, and those accounts leave links behind. A shared cookie hash across accounts claiming to be unrelated is among the fastest ways. Browser fingerprint overlaps and identical local-storage artifacts are other examples.
The goal is a graph showing which accounts share a device, which devices share a network, and which clusters behave in a coordinated way. A single-session check sees one account, while graph-based detection sees the ring behind it, connecting dozens of accounts to a handful of devices and exposing the operation’s structure.
Layer Device Signals With IP and Behavioral Data
A device signal gains confidence when the network and behavioral data point in the same direction. Data center IP addresses are a strong corroborating signal because real players don’t typically register from AWS or Google Cloud IP ranges. VPN and proxy detection adds another layer, especially when the proxy’s exit node is in a different country from the device’s reported locale.
Behavioral signals fill in what device and network data miss. Registration-to-deposit speed is one: a real player might browse the site, read the terms and deposit hours or days later, while a farmed account compresses the entire journey into minutes. Identical deposit amounts across accounts within the same device cluster, sessions with no organic navigation before conversion, and login patterns that follow a mechanical cadence rather than a human one all further raise the confidence score.
Watch for the Scale Tell
Farms operate in bursts. A ring that needs to create 200 accounts before a bonus promotion expires will generate a visible spike in registrations from the same device group inside a short window. The pattern is distinct from organic traffic, which is distributed more evenly over time.
Alerting on volume anomalies at the device-cluster level surfaces these bursts before accounts are activated and bonuses are claimed. The earlier in the lifecycle you catch the spike, the less damage the ring does.
Turning Detection Into Action
Detection without a decision is just monitoring. The value of the signals above depends on what happens after they fire.
The highest-confidence signals belong in auto-block rules. Where your own data shows a false-positive rate on legitimate players near zero, routing those flags through manual review adds delay without adding judgment. Moving them from review to firm block is the highest-leverage operational change most fraud teams can make.
Signals carrying moderate confidence, such as fingerprint similarity clusters, data-center IPs without a device flag and behavioral anomalies, suit a scoring model better. They raise an account’s risk score and, if it exceeds a threshold, route it for review. Below the threshold, they remain in the data, available for retroactive investigation when a confirmed ring surfaces.
The feedback loop is what improves the system. Every confirmed device-farm case is training data, so labeled outcomes need to flow back into the scoring model. Without that, detection stays static while the adversary adapts.
FAQ
What is a device farm?
A setup using multiple physical or emulated devices to create and operate fake accounts in bulk. The distinction that matters operationally is between hardware farms, which are limited by device costs, and emulator rings, which are limited only by the host machine’s capacity.
How do you detect an emulator?
By checking the device configuration for artifacts real hardware cannot produce, including emulator-specific model strings, absent motion sensors and virtualized GPU renderers. The check runs at the session level rather than the account level, which is why it can fire before a registration completes.
What is an anti-detect browser?
A tool built to defeat device fingerprinting by randomizing the parameters fingerprinting collects, among them canvas rendering, WebGL output, installed fonts and time zone. Its limitation is coverage. Spoofing a handful of surface parameters convincingly is straightforward, while spoofing several hundred consistently across every session is not.
How are device farm accounts linked together?
Through shared fingerprints, cookie hashes, browser artifacts and network signals, assembled into a graph rather than checked pairwise. Pairwise duplicate checks find identical devices. Graph analysis identifies clusters, including accounts that share no identical parameters with each other but connect through a common third party.
How do professional rings hide from fingerprinting?
With anti-detect browsers and spoofing tools that randomize collected parameters. Sustained spoofing across more than 200 parameters is difficult, so near-identical configurations, shared low-level hardware attributes, and corroborating IP and behavioral signals still expose the cluster even when no single parameter is duplicated exactly.
