How do you detect cloud phones and Android emulators?

Many apps rely on a few simple checks, but modern cloud phones and modified devices can bypass them quite easily.

I'm curious—if you've worked on Android security or anti-fraud systems, what signals have you found to be the most reliable?

I'd love to hear your experiences and compare approaches.