Cloud Phones Look Like Real Mobiles: Catch Farms at the IP Layer

Cloud phones appear to be real mobile devices when examined through a phone’s user agent, touch events, or a device fingerprint. However, the account farms on the other end are real or virtual handsets hosted in datacenters and remotely accessed by operators who spin up hundreds of profiles daily. Device-side checks often indicate a mobile device, while network-type blocklists usually offer little useful information, as the egress occurs within hosting space or behind a leased vendor connection.

To properly identify cloud phone farms, registration, claim, or payout processes require an IP-layer signal that recognizes the pattern rather than guessing about the handset. IP99 by ThreatHunter addresses this concern, with the cloud_phone signal being one of ten typed signals provided in the free GET /v1/ip/{ip} response. Alongside this signal, there is evidence_state and a 0–100 score that measures the freshness and strength of verifiable evidence, rather than the probability that a person is an attacker.

A cloud phone, unlike a naive rule, is a handset in a datacenter, remoted for bulk signup or farming purposes. It is considered a risk signal, distinct from mobile and hosting attributes that describe the network rather than risk evidence. Banning on hosting alone or treating every mobile ASN as a farm is not advisable. Search-engine exits, being benign, should not be involved in scoring.

Farms operate differently from Googlebot, which is why device signals alone are insufficient. Farms purchase the same stack as trusted clients: real Android images, real WebViews, and residential-looking fingerprints sold as a service. The trusted SDK typically reports a phone, but the fraud model sees mobile-shaped behavior. Your client SDK should rely on the IP-layer signal to detect cloud phone farms, as this evidence expires, and an address may be quiet today that was used by a farm yesterday.

IP99's stance on scores is that they expire, leading to evidence state updates: fresh evidence scoring, aged-out evidence, or never-seen evidence. These states inform the risk score and level, with cloud_phone being a stronger farm signal than bare hosting. The risk signals help explain the score, and it is essential to consider why it was scored.

The cloud_phone signal is a stronger farm indicator than bare hosting. Other signals like hijacked_proxy indicate the line owner is likely a victim, and the household should not be permanently banned. The share scope includes Pulse share_tier (T0–T3) for professional history or usage_type (IDC vs DYN / MOB) for free responses, before equating one ban with one building.

A score of 0 implies not a clean bill of health, while scores 1–29 require logging or observing, 30–69 call for verification without hard-ban, and 70–100 indicate a block only if business cost allows while respecting share scope.