Skip to main content
Question

Strange new trials starting in a bunch from same IP

  • Nov 9, 2026 2:49 PM UTC
  • 1 reply
  • 11 views
Forum|alt.badge.img+3

Hi.

On one of my app, I noticed a pattern of some kind of attack: Every few days, a bunch of new trials start. Between 8-16 at once, all at the exact same time, all from the same Chinese or Vietnam IP (sometimes it’s also a VPS IP like DigitalOcean), but all with different anonymous RC IDs. They never convert. I then started manually deleting those customers, and a bit later a smaller bunch reappears (again from the same IP, but with new different RC IDs and a fresh trial start time). Since I check trial eligibility, those must all be different/new Apple IDs.

Did anyone notice the same? What can be done about it? And I wonder what they’re actually trying to achieve?

Thanks

    1 reply

    alejandra-wetsch
    RevenueCat Staff
    Forum|alt.badge.img+6

    Hey ​@SwizzApps, 

    I’m sorry that you’re experiencing this. The fact that you're seeing 8-16 at the same time across different Apple IDs suggests a pool of devices or accounts is being automated together, rather than by a single person. Each trial hands them a working week of VPN access at once, and then they throw the accounts away and start over.

    While deleting the App User IDs from RevenueCat may temporarily remove their access to the Entitlements, if the device then restores purchases, the App User ID will be recreated, the receipt will be processed, and the entitlements will be regenerated. This could explain why you’re seeing them reappear after a few days.

    I would recommend implementing a way to block the Paywall from appearing or to restore purchases for users whose IP addresses match those of users abusing your service.

    You could also use Apple’s DeviceCheck: https://developer.apple.com/documentation/devicecheck to ensure you can distinguish between customers who have received premium content via a free trial in your app from that device already, or to mark the device as fraudulent to prevent them from getting access to your Paywall the next time they use your app.

    Hope this helps!

    Alejandra, Developer Support Engineer @ RevenueCat
    Terms & ConditionsAccessibility statement