AI Token Abuse: Stop Credit Farming and Unauthorized Use
Prevent AI token abuse across credit grants, accounts, API keys and payments. Learn what to check before issuing credits, granting access or using resources.
Pavel Nuryieu is Head of Research at ShieldLabs, where he studies how anti-detect browsers, proxies, and other anonymity tools work, and how detection keeps pace. He has spent close to a decade researching device fingerprinting and online fraud techniques.
Pavel Nuryieu's articles
How to Detect AI Agents on a Website
Detect AI agents on a website by separating operator identity, automation evidence and authorization. Protect accounts while permitting useful public crawling.
How to Evaluate Device Fingerprinting Accuracy on Real Traffic
Test device fingerprinting accuracy with independent ground truth, return recognition, collisions, splits and coverage. Keep benchmarks and claims separate.
Detecting Device Farms Behind Fake Web Accounts
Investigate device farm fraud in web accounts using device relationships, signup timing and benefit eligibility, while keeping legitimate shared use visible.
How to stop multi-accounting in online gambling: sportsbooks, poker, and casinos
How to stop multi-accounting in online gambling: why players open multiple betting accounts, the signals that link them to one person, and an operator playbook.
How to detect betting bots on sportsbooks, casinos, and poker sites
How to detect betting bots: the five kinds operators face, the device, network, and timing signals that expose them, and how to stop bot-driven abuse.
How to detect click farms
What a click farm is, how phone farms mass-produce fake installs, signups, and clicks, and how the devices behind that activity cluster back to one operation.
How to prevent bonus abuse in iGaming without an ID gate
How to prevent bonus abuse in iGaming: the signals that reveal one person behind many accounts, how casinos spot multiple accounts, and how to stop it.
VPN vs proxy vs Tor: how each hides traffic and how detection tells them apart
VPN vs proxy vs Tor: how each hides traffic, what each one still reveals, and how a detection layer tells them apart at the network level.
How to prevent gaming fraud: theft, RMT, and multi-accounts
How to prevent gaming fraud: account theft and resale, real money trading farms, cheating and smurfing, and the device signals that link the accounts.
What was Google's Privacy Sandbox, and why did it end in 2025?
Google retired the Privacy Sandbox in October 2025 and third-party cookies are staying in Chrome. What it was, why it ended, and what it means for fraud.
iCloud Private Relay: what it is, and what it means for fraud detection
iCloud Private Relay hides a Safari user's IP, but Apple publishes its egress ranges, so it is identifiable. What it is and how to read it for fraud.