Suspicious new users/devices from unexpected countries

Bohdan_analyst

Hi everyone,

Since September 13, we’ve noticed a sudden increase in new users (or devices) that seem to install our app and instantly drop off.

What’s unusual is that:

• These devices appear in countries (based on the Country property) where our app doesn’t operate, we have no marketing spend, and previously had no users.
• They only come from three Device Families:
  1. google Google mainline
  2. Meizu Phone
  3. OnePlus Phone
• Except for a few OnePlus devices, most of these users install the app, drop off immediately, and somehow trigger old events that were already deprecated by the time users appeared.

We’ve checked our backend data and confirmed that this doesn’t look like a bot attack or a data duplication issue on our side.

My questions are:

1. Who could these devices/users be?
2. How can we prevent them from being counted in Amplitude reports? (Drop Filters only work one year forward.)

Thanks in advance for your help.

Beth Saunders

Hey @Bohdan_analyst, it's hard to say who these devices could be. Very interesting how many of them there are. I asked our internal AI what could cause this, and here are some suggestions:

a. OEM pre‑installs or 3rd‑party app store distribution

• Clustering on very specific device families (google Google mainline, Meizu Phone, OnePlus Phone) and unexpected countries is a classic sign that:
  • Your APK was picked up by a regional OEM or 3rd‑party Android store (e.g., Chinese OEM store, alternate marketplaces), or
  • An OEM is pre‑installing an outdated version of your app as bloatware, which users immediately open once and abandon.
• If those devices all report:
  • The same or very old version of your app, and
  • An old SDK or build date,

that supports the “stale pre‑install / 3rd‑party store” hypothesis.How to validate in AmplitudeCreate an Events Segmentation chart filtered like:

• Event: your install/open event (e.g., App Start / Session Start / Install)
• Segments:
  • Filter: device family in {google Google mainline, Meizu Phone, OnePlus Phone}
  • Filter: _country in {the unexpected countries}
  • Group by: version, maybe library or user_agent

If you see that these all run an older build than your official store version, and they never perform your “normal” events, that strongly supports this hypothesis. [Unverified]

b. Emulator farms, install‑fraud or aggressive testing traffic

• Another possibility given:
  • Immediate drop‑off
  • Constrained device families
  • Unexpected countries

is that you’re seeing a fraud ring or emulator farm that uses a few standard device profiles.

• These operators often:
  • Install, open once, trigger some simple flows, then discard the device profile.
  • Reuse very old APKs they’ve scraped, which would explain deprecated events suddenly firing.
• These devices often share:
  • Similar IP ranges
  • Limited sets of device models / OS versions
  • Weird user agents

You can partially verify this by grouping the same cohort of devices by ip_address, os, device, and user_agent. If you see heavy concentration on a few IPs or obviously synthetic user agents, that leans toward fraud/emulator traffic. [Unverified]

c. Side‑loaded old builds from backup images 

A smaller‑scale variant is users in other countries who:

• Download an old APK from an APK mirror or clone, or
• Restore a backup image containing an outdated app build.

Those users could:

• Trigger your old event schema (deprecated events) on first open.
• Immediately churn because the app doesn’t function properly in that region.

Again, this would show up as:

• Old version / build numbers
• Old SDK versions
• Possibly non‑official distribution channels if you’re tracking that as a property.

d. Why “old deprecated events” are firing now

Given that these users appear well after you deprecated those events, the simplest explanations that fit your symptoms are:

• Those events are still in the code of an older app version being used by: OEMs, side‑loaders, or fraud operators.
• Or an integration (e.g., a partner, SDK wrapper, or 3rd‑party tool) is replaying cached events from an older build when installed on these specific devices.

Check whether all the suspicious users share the same app version and SDK version; if yes, this is almost certainly a stale build or integration artifact rather than a new bug in your current app.

If you know the devices and the countries they're coming from, you could setup a block filter for them as well so going forward the data isn't capture?