Case Study 94% of my push budget went to a phone farm hiding in partner feeds

Quick background: I'm a developer, not a full-time buyer. I ran a small push test for one of my own sites, a local services directory in Belarus, goal was sign-ups. Two campaigns, $10/day each, CPC $0.005, default targeting. I didn't touch the "partner traffic" option, it was on by default (72 feeds).

Day 1 (Oct 13)
Both campaigns burned the daily cap in about 80 minutes. Clicks came in evenly, around 50 per minute. 4,058 clicks, 0 sign-ups.

What the visits looked like

I log every request on the server before the site sees it, so I went through the raw headers. 98% of the clicks had the same pattern:

• the phone sent its model, RAM, Android version and a 980px viewport on the very first request. Normal Chrome only sends that when the site asks for it (client hints), and my site never asks. Out of ~3,200 visits to my other sites that day, not one did this
• 349 different phone models, almost all China-market
• the same Pragma: no-cache + Cache-Control: no-cache and the same browser language on all of them
• 657 placements with near-sequential IDs, about 10 clicks each on average, the top ones