One phone, 200 new devices: phone farms in private browser windows

Short answer

Fingerprint the device twice: once with every component, and once with everything except the canvas. When many new accounts from one network share the second fingerprint but each has a different canvas, it is one phone redrawing its canvas in private windows. Many people with the same phone model share the canvas too, so count distinct canvases, not distinct device ids.

One phone, three offerwalls

About 200 new accounts in 7 days from one mobile network: 139, 42 and 19 on three offerwalls.

A new canvas for almost every account

122 different canvases for 139 accounts; screen, cores, clock, language, graphics, audio and math fingerprints identical.

One click, one conversion

Most accounts clicked one low-payout offer, converted once and were never seen again.

Real phones that look alike

Identical iPhones on one carrier: up to 29 new accounts a week, but only 4-5 canvases.

What one phone did in a week

The accounts arrived on three offerwall networks at once, through several of their publishers. Each one came from a different IP of the same mobile network in Malaysia, opened the offerwall, clicked a low-payout offer, converted once and never came back. On the biggest of the three walls, 235 of its 286 events were allowed.

Each account looked like a new device, so no device check linked them. Laid side by side, their browser scans told a different story:

Everything a phone cannot change between two sessions was the same. Only the canvas changed, nearly every time. A second phone, on a mobile network in Sudan, ran the same routine on one of the walls that week: 15 accounts, 12 canvases.

Why a fingerprint misses it

Most device fingerprints hash the canvas with everything else, because on an ordinary browser the canvas is one of the most stable and distinctive components. Private windows in Firefox, and browsers such as Brave, protect their users by adding noise to the canvas once per session. The phone stays the same; its fingerprint does not.

Firefox on Android also reports a single font, so a fingerprint built on fonts, canvas and graphics has very little left to tell two such phones apart. Many fraud checks treat a fingerprint that thin as too weak to link accounts on, which is right for strangers and exactly what a farm wants.

The network did not help either. A mobile carrier hands out a new address each time a phone reconnects, so a limit per IP saw a stranger behind almost every account, and none of those addresses belonged to a VPN, a proxy or a hosting company. On the IP side, the phone looked like a hundred ordinary customers of one carrier.

The profile without the canvas

Keep a second hash of every scan with the canvas left out: the user agent, the screen size and pixel ratio, the number of cores, the time zone and language, and the graphics, audio and math fingerprints. On one phone it does not change between private windows; a farm cannot change it without changing the phone.

-- New accounts per profile (canvas left out) and /16, last 7 days
SELECT s.profile_hash,
       SUBSTRING_INDEX(s.ip, '.', 2)       AS network,
       COUNT(DISTINCT s.account_id)         AS accounts,
       COUNT(DISTINCT s.canvas_hash)        AS canvases
FROM scans s
JOIN accounts a ON a.id = s.account_id
WHERE s.created_at >= NOW() - INTERVAL 7 DAY
  AND a.created_at >= NOW() - INTERVAL 7 DAY
GROUP BY s.profile_hash, network
HAVING accounts >= 13 AND canvases >= accounts / 2;

One phone, or many people with the same phone?

The profile alone is not enough. Two people with the same iPhone, the same iOS version and the same carrier have the same profile, and a popular phone on a big carrier can bring dozens of new accounts a week. What gives the farm away is the canvas: identical phones draw identical canvases, while one phone in private windows draws a new one each time.

Counting device ids instead of canvases would have flagged both groups of real users: their browsers clear storage and get new ids too. Across the 408 groups of a dozen or more scans we saw that week, only three had a canvas for almost every account, and all three were the same phone on three offerwalls.

What to do with the accounts you find

A farm like this one takes one conversion per account and moves on, so blocking its next account matters less than dealing with the ones already credited. Treat the group as one person, because it is one phone:

• Hold the cashouts of every account in the group, not only the one you noticed first.
• Send the transaction ids of their conversions to the offerwall or the advertiser while they can still be reversed.
• Look at which publishers or placements sent them. This phone came through several of them on three networks at once, so no single publisher's numbers looked wrong; the device side was the only thing tying them together.
• Keep the profile on a watch list. A phone that opened 139 accounts in a week will be back with the next batch, and its profile will not have changed.

If you run a network, tell the publishers whose placements carried the accounts. They usually cannot see the pattern from their side either: to each of them it was a handful of new users who converted once, which is what good traffic looks like.

How CashoutGuard does it

Since 2 November 2026 every scan keeps a profile hash with the canvas left out. device_clones marks a new account whose profile was seen on 12 or more other new accounts from the same /16 network in the last 7 days, when at least half of those scans drew their own canvas. It weighs 55, a review on default settings, and 80 from 30 accounts.

Applied to the week before it shipped, it moved about 215 accounts of the two phones from allowed to review or block, most of them with a conversion already credited. It fired on no other group.