How to detect click farms
What a click farm is, how phone farms mass-produce fake installs, signups, and clicks, and how the devices behind that activity cluster back to one operation.
Pavel Nuryieu is Head of Research at ShieldLabs, where he studies how anti-detect browsers, proxies, and other anonymity tools work, and how detection keeps pace. He has spent close to a decade researching device fingerprinting and online fraud techniques.
Pavel Nuryieu's articles
How to prevent bonus abuse in iGaming without an ID gate
How to prevent bonus abuse in iGaming: the signals that reveal one person behind many accounts, how casinos spot multiple accounts, and how to stop it.
VPN vs proxy vs Tor: how each hides traffic and how detection tells them apart
VPN vs proxy vs Tor: how each hides traffic, what each one still reveals, and how a detection layer tells them apart at the network level.
How to prevent gaming fraud: theft, RMT, and multi-accounts
How to prevent gaming fraud: account theft and resale, real money trading farms, cheating and smurfing, and the device signals that link the accounts.
What was Google's Privacy Sandbox, and why did it end in 2025?
Google retired the Privacy Sandbox in October 2025 and third-party cookies are staying in Chrome. What it was, why it ended, and what it means for fraud.
iCloud Private Relay: what it is, and what it means for fraud detection
iCloud Private Relay hides a Safari user's IP, but Apple publishes its egress ranges, so it is identifiable. What it is and how to read it for fraud.
How to prevent Sybil attacks: catching one actor behind many identities
How to prevent Sybil attacks: the defenses across the protocol and application layers, and how to catch one actor running many wallets or accounts at the frontend.
Passwordless authentication: how it works, methods, and limits
What passwordless authentication is, how it works, the main methods from passkeys to magic links, its benefits and limits, and where device signals fit.
Account recovery fraud: how attackers take over accounts through the reset flow
Account recovery fraud is how attackers bypass strong login by abusing the reset flow. How it works, why recovery is the weak point, and how to defend it.
Trial farming and credit farming on AI products: how one operator drains your free credits
What trial farming and credit farming mean on an AI product, not the gaming kind: how one operator drains free compute credits, and where it is caught.
Device-based authentication: recognizing the trusted device behind a login
What device-based authentication is, how recognizing a trusted device makes login transparent, how it differs from passkeys and cookies, and where it fits.
Adaptive authentication: the device signal that decides when to step up
How adaptive (risk-based) authentication works, the signals it weighs, and how recognizing the trusted device decides when to step up and when to let a user through.
How to prevent free-trial abuse without losing real customers
How to prevent free-trial abuse: what it costs you, the signals that flag a recycled trial, and a playbook to stop it at signup without blocking real users.
How ban evasion detection works: re-identifying returning banned users
How ban evasion detection works: why account-only bans fail, the signals that re-identify a returning banned user, and how detection ties a new signup to the old account.
How to detect anti-fingerprint browsers (2026)
Anti-fingerprint browsers spoof canvas, WebGL, fonts, and TLS to break recognition. How to detect them in 2026: the fingerprinting methods and the tells they leave.
Browser spoofing: what it is and how spoofed browsers give themselves away
What browser spoofing is, what attackers fake (user agent, OS, screen, timezone), and how a spoofed browser betrays itself through signals that disagree.
How to detect Tor traffic without blocking real users
Detecting Tor traffic is easy because exit nodes are public. The hard part is acting on it without blocking real users. How web detection actually works.
What is WebGL fingerprinting? How the GPU gives a device away
WebGL fingerprinting identifies a device by how its GPU renders 3D graphics. How it works, what it reveals, and how it differs from canvas.
What is font fingerprinting? How your installed fonts identify you
Font fingerprinting identifies a device by which fonts are installed, read from how text renders. How it works, what it reveals, and how stable it is.
What is audio fingerprinting? The browser technique, explained
Audio fingerprinting identifies a device by how it processes a sound signal in the browser. How it works, what it reveals, and how stable it is.
Impossible travel detection: reading the device behind the location
Impossible travel detection flags an account logging in from two far-apart places. Why velocity alone over-fires on VPNs, and how the device fixes it.
Residential proxy detection: why home IPs are the hardest to catch, and how detection actually works
What a residential proxy is, where the home IPs come from, why IP checks miss them, and how residential proxy detection actually works without relying on the address.
What is browser fingerprinting? Detection methods + countermeasures
Browser fingerprinting identifies a device from 100+ datapoints. Learn how canvas, WebGL, and IP signals work, plus detection methods and countermeasures.
What is canvas fingerprinting? How it works and why it is so stable
Canvas fingerprinting identifies a browser by how it renders a hidden image. How it works, what it reveals, how stable it is, and its role in fraud detection.
10 browser fingerprinting techniques explained
The main browser fingerprinting techniques: canvas, WebGL, audio, fonts, TLS (JA3/JA4), and more, what each one reads and how stable it is.
How to detect anti-detect browsers in 2026
Anti-detect browsers fake a new device per profile to power multi-accounting. How to detect them: the signals that expose them and why no one check is enough.