What Is a Bot Farm? The Complete Guide to How They Work

As far as percentages go, depending on who you believe, bots have come to occupy between 33% and more than 50% of web traffic. According to Cloudflare Radar, this number reaches 57%, according to Imperva's 2026 Bad Bot Report, this number hovers just above 50%, and according to independent crawling of the top 10,000 sites, it reaches just over 47%. The discrepancy in these numbers is, in itself, a hint at the issue: bot farms are the very reason no one agrees what defines “automation” and what constitutes “abuse.”

You may have never heard about a bot farm before; however, you've definitely felt the results of their work whether you are managing a social media account, running sponsored ads, conducting e-commerce checkouts, or even trying to analyze your data without throwing away your laptop. In addition to the regular explanation of the term, this article will provide more information about the bot farm: how it is built, who buys them, how much money it costs, how the AI has revolutionized this market for the last two years, and what will stop them in 2026 and not in 2017.

What Is a Bot Farm?

bot farm are coordinated groups of automated accounts, devices, or software sessions controlled collectively, often by just one controller, in order to imitate multiple independent human users. The goal is usually identical: to create the impression of organic activity performed by a large number of people that could not be done manually.

This is the key distinction between a bot farm and one script or bot. It is annoying if one scraper accesses your website. Bot farms consist of hundreds or thousands of identities working together that can click, like, comment, sign up, purchase, and log in without being recognized.

Three things define a bot farm, regardless of what it's built from:

• Coordination. They are not working on their own; instead, there is a central controller (or a controller offering access-as-a-service), which decides what they do and when.
• Identity proliferation. Each bot represents itself as a separate identity, i.e., a separate device, IP address, browser profile, or account, to bypass user-specific and source-specific limits.
• Disguise. This is precisely the idea – to disguise themselves as legitimate humans, rather than to reveal themselves as bots.

Bot Farm vs. Click Farm vs. Botnet vs. Troll Farm

The above four terms are often used interchangeably in online discussions, which is actually one of the main reasons for the many problems associated with them. In fact, there are many instances in the media where they have been treated as synonyms of each other.

Term	What it actually is	Primary output
Bot farm	Automated infrastructure (software, devices, or cloud agents) built to generate fake engagement or traffic at scale	Clicks, views, likes, follows, form fills, logins
Click farm	The human-labor version — real people, often paid per task, manually clicking ads or engaging with content	Manual clicks, engagement, sometimes reviews
Botnet	A network of compromised devices (infected computers, IoT devices, routers) controlled without the owner's knowledge	DDoS attacks, spam, credential stuffing, crypto mining
Troll farm	An organization of (often human, sometimes bot-assisted) operators producing coordinated political or ideological content	Disinformation, coordinated narratives, astroturfing

The intersection point is that a bot farm could operate on the top of a botnet (with stolen devices providing the necessary scale and IP diversity), while a troll farm usually uses a bot farm as a distribution mechanism. Similarly, a click farm might turn into a combination, with actual humans caring about many bot-controlled virtual devices just in order to solve tasks which cannot be automated. Indeed, today's real-life examples of large "bot farms" are mostly hybrid versions of at least two of these.

How a Bot Farm Is Actually Built: The Technical Anatomy

This is where most explainers stop at "a room full of phones." That image is real, but it's now the low end of the market. Here's the full stack, from the physical to the fully virtual.

1. Device farms (physical)

The traditional configuration consists of dozens or even hundreds of cellphones, which have been put into specialized racks that are running automated software (via either USB debugging or accessibility-service vulnerabilities) on one central computer. Each cellphone has its own SIM-card, and thus each of them has its own mobile IP address and can get SMS-code verifications, which is why during the destruction of such botnets (as Ukraine's SBU has done dozens of times since 2022), thousands of SIM-cards and GSM gateways are found.

2. SIM farms and GSM gateways

A GSM gateway enables one single controller to manage hundreds of SIM cards simultaneously and direct call/text through these SIM cards as if each one of them were individual mobiles in different locations. This is the very basis of the SMS verification hack that helps a bot farm to make 10,000 unique accounts in the application which requires phone verification.

3. Virtual device farms and emulators

Instead of using physical devices, operators employ Android emulators (in their dozens and even hundreds on a single server) to present themselves to all applications or websites that seek a device. To bypass device fingerprinting tests, legitimate tools for app testing are used but are made to represent not only the device model and OS version but also sensors and app lists.

4. Headless browsers

This is the change that made all the difference for bot farms based on the internet. Headless browser frameworks such as Puppeteer, Playwright, and Selenium use a fully functional browser engine that has no window at all. The reason why it can be detected is because it is a fully functional browser rendering an actual webpage, which will pass any test that would be applied to an HTTP request – it executes JavaScript challenges, loads images, and produces browser fingerprints as a real user would.

5. Residential and mobile proxy networks

Instead of routing traffic via easily blacklisted data center IPs, they get hold of the residential proxies - sets of IP addresses of actual consumers, often collected using the SDKs of free apps and/or VPN services that users have unknowingly subscribed to. Thus, each time the bot connects, it appears to come from an entirely new real household in a new city and connected via a different ISP. That single innovation made IP blocking almost useless against sophisticated campaigns.

6. CAPTCHA-solving layers

CAPTCHAs used to be the last bastion. There are two reasons behind this: cheap labor for solving CAPTCHAs by humans (the people, usually from regions where wages are quite low, get paid a few cents for each task they perform) and, lately, machine learning algorithms that are able to solve image and audio CAPTCHAs by themselves, being able to reach an accuracy level that is comparable to human performance on the very same problem.

7. Orchestration and account-management software

This specialized software, either publicly advertised as “growth” or “automation” applications, or privately sold via secretive corners of the internet, where they’re sold as bot-farm kits, combines all of these features: scheduling, identity change, variability of timing and mouse actions to avoid detection through pattern recognition, and management of the account life cycle when an account gets banned and needs replacement.

Why Bot Farms Exist: The Economics

Bot farms are around because fake engagement and fake traffic can be monetized straight off, on both ends of the exchange. Money explains everything faster than anything else when it comes to this problem.

Someone is always the customer. Bot farms are a service industry. Buyers include:

• Growth buyers of social media. — people, companies, and political campaigns purchasing followers, likes, views, and comments to create social proof. Various analyses of platform accounts have from time to time placed the percentage of automated accounts on leading social-media platforms in the high single to low double digits relative to the overall account count, but methodology and platform enforcement keep shifting those numbers.
• Streamers and content creators. buying views on Twitch or YouTube to achieve monetization, or simply to appear more popular to the algorithmic recommendation engine.
• Competitors or ad-fraud organizations. clicking a rival's PPC ads to exhaust their daily budget or to run bots to drain money from their affiliate marketing or ad-network placements through fraud.
• E-commerce participants. running bots to purchase limited-drop inventory (shoes, GPUs, tickets to concerts) for resale or to continuously scrape competitor prices.
• Politically or state-backed entities. running bot farms to spread propaganda, silence opposition through report brigading, or cause panic — here the terms "bot farm" and "troll farm" apply most closely, and also the point of greatest law-enforcement efforts (especially those made by Ukraine due to its information warfare with Russia).
• Fraudsters. bot farms for credential stuffing (testing stolen username/password combinations on

The one controlling the farm does not have any sort of connection with what happens after — they are just selling an infrastructure and connectivity at some price, depending on the followers, views, clicks, or accounts.

How AI Rebuilt the Bot Farm Industry (2024–2026)

If you read an explainer written before 2024, it's describing a different industry. Three developments compressed years of arms-race evolution into about eighteen months.

Generative AI put an end to the "obviously fake" age. Previously, it was clear from the repetition and incoherence of the bot-produced text. Now, LLMs create coherent and stylistically varied reviews, comments, and social media posts, which makes detection based on the content virtually impossible.

The behavioral realism issue is also overcome. Previously, bots could be detected by entropy of mouse movements, scrolling, or clicking speed — now the detection algorithms face the challenge of bots specifically trained to produce human-like patterns of interaction, slightly imperfect and hesitating and varied from session to session, as any other human's interaction would be.

Agent infrastructure reduced the cost of scaling to virtually nothing. A sophisticated bot farm now can be one cloud server, hosting hundreds of autonomously operating AI agents at once, each connected through its residential proxy and producing its own independent, fully-realistic browsing session — without the need for any facility, any physical SIM-cards or humans in the first place. There is literally nothing to attack.

These traffic statistics confirm the change. As reflected in industry crawl reports up to 2026, the percentage of bot traffic attributable to both AI crawlers and AI agents increases dramatically each year – in certain estimates, the share of traffic associated with AI crawlers doubles from 2024 to 2026, while the "dumb" bots for which classic defense mechanisms like IP blocklisting, static CAPTCHA challenges, and user agent filtering are designed represent an ever-smaller portion of the total bot traffic pie. The bots that old defenses were designed to detect are increasingly irrelevant – the bots that pretend to be human are not.

In other words, the relevant question has shifted. It is no longer "Is this IP address associated with a known bot?" The new question is something more along the lines of: Who is this visitor? Does its activity reflect normal human or customer behavior?

Signs You're Dealing With Bot Farm Traffic

Some patterns are consistent enough across bot-farm activity to serve as practical red flags, even without specialized tooling:

• Visits/CPCs/sig-ups that don't result in conversions/purchases/engagement. When traffic rises sharply but conversion/purchase/engagement rates remain constant or drop, it is indicative of bots and not actual human activity.
• Traffic anomalies related to geography or traffic source. Unusual activity from an unexpected location, one that has no relation to the geographic target or advertising campaign or products available.
• Atypical session speed and/or consistency. Human beings do not behave identically in web browsing sessions. Large-scale bot activity and even artificial intelligence-powered bot activity tends to create sessions that exhibit statistical anomalies.
• Bounce rate and zero interaction depth. Sessions where visitors land on the landing page and immediately leave, without scrolling or clicking or time spent on the page.
• Account/registration abuse. A large number of new accounts created with disassociated emails, naming conventions, and same metadata.
• Clusters of login failures. A sudden rise in failed login attempts across multiple usernames and from an infrastructure base with limited diversity, which is the hallmark of credential stuffing attacks.
• Unrealistic engagement based on timing or content. Engagement activities coming in faster than the real people could interact, or disassociated from the content being shared.

None of these on its own can prove anything. The giveaway is always their combination, appearing at the same time in multiple sessions — and that’s precisely why individual event-based detection fails when confronted with automated coordination, and why aggregate behavior-based detection has emerged as the norm.

How to Actually Defend Against Bot Farms in 2026

The use of IP blocking and static CAPTCHA is necessary but not enough – both have become easily bypassed due to the aforementioned residential proxy and AI solving layers. What’s needed nowadays is a multi-layered approach:

1. Behavioral and device fingerprinting. Don't focus only on IP address and expand your fingerprint to the whole set of signals: browser/device fingerprint consistency, mouse and touch entropy, timing distributions, and reoccurring the same "device" with different identifiers.
2. Rate limiting and progressive friction. Scale friction up proportionally – normal people don't feel it, and automated bots doing massive amount of logins, forms submissions or checkouts encounter increasing difficulties.
3. Multi-factor authentication on critical actions. It won't protect you from bot farms crawling your site, but it greatly increases the price of account takeovers or successful credential stuffing.
4. Classification of entities and intents. Don't classify bots vs humans. Instead classify what kind of an entity this is, how internally consistent its identifiers are, and what it's trying to do – separating genuine automation (search engine crawlers, AI bots executing for the real user), from malicious traffic that is looking like this at first sight.
5. Server- and network-side validation. Client-side validation is easy to bypass with headless browsers, while request patterns, headers analysis and TLS fingerprinting from the server side complement the JavaScript challenges.
6. Honeypots and invisible traps. Fields or links visible only to the bots but not
7. Monitoring all the time, not just filter. Operators evolve very quickly after deployment of any kind of new defense solution and hence static rulesets become irrelevant. Good programs consider bot farm defense as a detection loop, not an integration.
8. Control over your own automated identity. In case your organization uses any kind of legit bots, scrapers, and AI agents, make sure that they are inventoried, authenticated, and different from non-legit automation – otherwise your defenders will not be able to distinguish between friends and foes and thus will make mistakes.

Is Operating a Bot Farm Illegal?

Not usually in such a direct manner — at least, this will probably surprise many people. In most countries, there is no law prohibiting “running scripts automatically on the Internet.” It is the purpose of a bot farm that generates legal liability.

• Violation of the Terms of Service (almost all platforms have them) – enough for banning the user and the botnet, but not for criminal responsibility alone.
• Click fraud and ad fraud – it may give grounds to civil responsibility, and in the most proactive cases even wire fraud will be applicable, as it implies fraudulent activities aimed at advertisers and ad platforms.
• Unlawful access to computers – such laws as U.S. Computer Fraud and Abuse Act may be applied when bots bypass access control and violate the terms of system usage in certain ways.
• Telecom and regulatory offenses – most of the busts of the bot farms in reality happened due to the fact that there were no registrations of SIM-cards and illegally imported telecom devices, rather than because of the bot farm activity.
• Elections and information laws – in some jurisdictions there have already appeared crimes of coordinated inauthentic political amplification.

In reality: the legal accountability usually flows from the fraud, deception, and unlawful access perpetrated through the bot farm, not the bot farm itself. This difference can help to account for the persistence of the industry and why detection and governance are more crucial than law enforcement.

Frequently Asked Questions

How many bots make up a typical bot farm?

There is a huge variety in terms of size ranging from a small group of bots managed by one person to large farms managing tens of thousands of user profiles. Raids on enforcement have uncovered farms managing from about 3,000 up to more than 20,000 bots, and there is virtually no limit on how much a cloud-based AI agent can manage.

Are your social media followers really real or bots?

Warning signs would be an absence of a profile picture, the use of generic or AI pictures, absence of original posts but sharing posts, similar comment patterns, and ratios of following/followers different from normal behavior. There is not one warning sign alone that would tell you anything as sophisticated bot-farms are created to blend in with normal profiles.

Do bot farms impact small web sites, or is it just large sites that get impacted?

Both. In fact, bot attacks are more significant for small web sites relative to large ones, because a small increase in bots can have a major impact on small amounts of traffic and analytics data, and use up advertising budgets faster than they would for a large web site.

The Bottom Line

The rise in detection didn’t result in a decrease in bot farms; it only made them more difficult to detect. Whereas the practice of placing many phones onto shelves has evolved into the use of cloud-based infrastructure with no physical location or SIM cards to trace, and the traffic generated by this method has been intentionally designed to look like a legitimate visitor to anyone using older methods of analysis. Companies that handle the threat of bot farms best in 2026 will not be those with the most restrictive IP blocklist; they will be those who analyze their traffic based on identity, behavior, and intent.