Bot Farms Explained: How They Work, What They Cost, and the Law

A bot farm is a centrally run network of phones, computers or cloud servers, sometimes worked by paid staff, that produces fake online activity at scale: clicks, ad views, likes, reviews, accounts and posts.

Picture a room of cheap Android phones on metal racks, each plugged into a charger and logged into a different account. Software taps, scrolls and clicks on all of them at once. A few workers walk the rows, swapping SIM cards and restarting frozen devices. That is the version in the news photos. Many farms today never touch a phone at all. They are rented servers pretending to be thousands of people.

For anyone running paid ads, one part matters most. Some of what these farms click is your ads. Every one of those clicks is billed, and none of them will ever buy.

This guide covers what bot farms are, how they differ from click farms and botnets, how they work, what they're used for, how they make money, what they cost, whether they're legal, where they operate, and how to spot and limit their traffic in your ad accounts.

What Is a Bot Farm?

A bot farm is a coordinated set of devices or servers that act like many separate people online, so one operator can fake activity at volume.

There are three main kinds.

Phone farms are racks of real smartphones run by software. Each phone is logged into its own account and often sits on its own mobile connection. Real phones on mobile networks look like ordinary people, which is the whole point.

Server farms skip the phones. They run software copies of browsers and phones on rented servers, which makes them cheaper and far bigger. US prosecutors described one in detail. The scheme known as Methbot ran on more than 2,000 rented servers in Dallas and Amsterdam, programmed to fake mouse movement, scrolling and video playback so the ad views looked human.

Hybrids mix both. Real phones handle jobs that need a real device, servers supply the volume, and paid staff step in for anything a script can't do, like solving a CAPTCHA or passing an account check.

US court documents in a 2024 case gave a narrower, social media version of the definition: a software package that creates false personas on social platforms, which can be boosted with AI that generates profile images and writes posts.

What makes it a farm rather than a single bot is coordination. One operator runs hundreds or thousands of identities, all pointed at the same targets. If you're new to the wider topic, start with what bots are and the main types.

How Is a Bot Farm Different From a Click Farm, Botnet or SIM Farm?

A bot farm runs devices its operator owns or rents. A click farm pays people to click, and a botnet hijacks other people's computers without consent.

The terms get mixed up constantly. Here is how they line up.

One US case shows the bot farm and botnet difference side by side. In 2018, federal prosecutors in Brooklyn charged two ad fraud rings together. The first, Methbot, rented its own servers and dressed them up as home computers. The second, known as 3ve, reached more than 1.7 million infected computers belonging to ordinary people and businesses, who never knew their machines were loading ads in the background. Prosecutors said that scheme made businesses pay more than $29 million for ads no person ever saw.

The SIM farm entry comes from Europol, which defines it as a group of SIM boxes, each housing hundreds of SIM cards. Farms use them to receive the verification codes that platforms send when an account is created.

Click farms are the human version, and in practice the line is blurry: most operations mix people and software. We cover the human side in click farming: how it works, and the single-script version in our guide to click bots.

How Do Bot Farms Work?

Bot farms run the same script on many devices at once and give each device its own identity, connection and account so the visits look unrelated.

Each layer exists to make the fake activity harder to tie together.

The Hardware

A physical farm looks like a server room for phones. Metal racks hold hundreds of cheap Android devices, wired to power and often to a central computer through USB hubs. Some farms use old laptops or tablets instead, depending on the job.

SIM cards get swapped to give devices fresh mobile connections. Larger operations use SIM boxes that hold hundreds of cards and switch between them automatically.

Server farms replace all of this with rented machines. Nothing physical sits in a warehouse, and the operation can grow or move in an afternoon.

The Software

Automation software drives every device. At the simple end, scripts tap set points on the screen, scroll for a set time and move between pages. More advanced farms use public testing tools such as Appium, Selenium or Puppeteer to imitate real browsing.

For web traffic, farms often use browsers built to disguise automation, such as Multilogin and similar products. Each session reports its own screen size, language, time zone and device details, so a thousand sessions from one rack look like a thousand different shoppers.

The Connections

Every device cycles through IP addresses. Many farms rent connections that run through real home internet subscriptions, so the traffic appears to come from houses rather than servers.

Methbot went further. Its operator leased more than 765,000 IP addresses and registered them in the names of major US internet providers, so his servers looked like people at home and at work across the United States.

The People

This is what makes farms hard to catch. Many operations employ staff alongside the software. They solve CAPTCHAs when one appears, type in verification codes, and rescue accounts that get flagged.

A CAPTCHA only tests the moment it appears, and a paid worker passes it like any customer would. We compare the two approaches in CAPTCHA vs bot detection.

Some operations are almost entirely human. Workers click and scroll by hand for hours, which produces behavior that is genuinely human because a person is doing it. At that point the "bot" part is the coordination, not the clicking.

Rotating Identities

A farm rarely reuses an identity for the same client. Each job gets a fresh mix of device details, connection, account and browsing history. When the job ends, that identity is retired or moved to another client.

This is why single visits look normal. The coordination only shows when you look at hundreds of sessions together.

What Are Bot Farms Used For?

Bot farms are used for ad fraud, fake followers and reviews, fake account sign-ups, ticket and stock hoarding, and political influence campaigns.

The services are sold openly on websites, freelance marketplaces and messaging channels. Here is how each one works.

Ad Fraud and Click Fraud

Bot farms are one of the main engines of click fraud. They click pay-per-click ads to drain a competitor's budget, or to earn money for a publisher that shows ads on its own sites.

The advantage over a simple script is realism. The clicks come from real phones or well-disguised servers, so blocking a list of suspicious addresses catches little.

Farms also produce fake impressions and video views, which you pay for on CPM buys. Methbot loaded real ads on blank pages while claiming they ran on more than 6,000 publishers' sites, including The New York Times and the New York Post. For the wider picture, see what ad fraud is and how the industry classifies invalid traffic.

If your campaigns count form fills as conversions, farm traffic can also fill your forms with made-up details. Your campaign then reports leads that never answer the phone.

Fake Followers, Likes and Views

This is one of the largest markets. Clients pay to inflate follower counts, likes, comments and views on Instagram, TikTok, YouTube, X and Facebook. Our guides to Instagram bots and TikTok bots show what those fake followers look like from the receiving end, and how to remove them.

The FTC's case against a company called Devumi shows the scale. It filled more than 58,000 orders for fake Twitter followers, more than 32,000 for YouTube views and more than 4,000 for YouTube subscribers. Buyers included performers, athletes, writers, law firm partners, investment professionals, and marketing, advertising and PR firms buying LinkedIn followers.

For advertisers the cost is indirect. A brand that pays an influencer by audience size may be paying for followers who do not exist.

Fake Reviews

Farms write five-star reviews for clients and one-star reviews for their rivals, on marketplaces, map listings and app stores. Both are sold as packages.

Fake reviews mislead real shoppers and undercut honest businesses. Since October 2024 an FTC rule also bans buying them, as the legal section below explains.

Fake Accounts and Sign-Up Abuse

Farms create accounts in bulk. They use them to claim sign-up bonuses and free trials again and again, to send spam, and as raw material for other fraud.

SIM farms supply the phone numbers those sign-ups need. In October 2025, Latvian police and Europol took down one such service. Europol reported at least 1,200 SIM boxes running 40,000 SIM cards, with numbers registered to people in more than 80 countries, and more than 49 million online accounts created through it.

Ticket and Stock Hoarding

Ticket bots, sneaker bots and GPU bots buy limited stock faster than any person can, then resell it at a markup.

In August 2025 the FTC sued a Maryland ticket broker, alleging it bought at least 379,776 tickets in just over a year using thousands of accounts, disguised IP addresses and SIM boxes to receive verification codes. The case is pending.

Political Influence

In July 2024 the Justice Department seized two domains and searched 968 social media accounts tied to an AI-enhanced bot farm. The department said Russia's state broadcaster RT developed it and the FSB security service operated it, and that its fictitious profiles often posed as Americans. X suspended the remaining accounts.

Political farms get the headlines, but they are not the bulk of the market. In a 2019 experiment, NATO's StratCom research centre assessed that more than 90% of engagement bought on social media is used for commercial purposes.

How Do Bot Farms Make Money?

Bot farms make money in two main ways: selling fake followers, views and reviews, and collecting ad revenue for views no person made.

Selling engagement is a volume business. Each order is cheap, so a farm serves many clients at once from the same racks and accounts. Devumi's tens of thousands of orders show how a single seller adds up.

Ad fraud pays more. A farm, or the publisher or ad network it works for, gets paid for every ad view or click it fakes, and the advertiser covers the bill. Methbot took more than $7 million from US advertisers, publishers and platforms, and the 3ve botnet cost businesses more than $29 million.

Selling to other fraudsters is a third stream. Ready-made accounts, phone numbers and verification codes are products in their own right, which is what the SIM farm service Europol dismantled was selling.

Competitor attacks are sold too: clicking a rival's ads to burn through its daily budget. Nobody publishes how big that market is, which is part of why it's hard to prove.

The money can be real enough to bring real prison time. Methbot's operator, Aleksandr Zhukov, was arrested in Bulgaria, extradited to the US and sentenced to 10 years in 2021.

How Much Do Bot Farms Cost?

Buying from a bot farm is cheap: researchers paid €300 for 3,530 comments, 25,750 likes, 20,000 views and 5,100 followers in 2019.

The best public price data comes from NATO's StratCom research centre, which buys fake engagement on purpose to test how well platforms remove it.

In 2019 the researchers bought from 11 Russian and 5 European providers, across Facebook, Instagram, Twitter and YouTube. In 2022 they added TikTok and VKontakte and bought from Russian, Indian and Nigerian providers. More than 93% of the 27,309 fake engagements were still online four weeks later.

What it costs to build and run a farm is a different question, and no reliable public figure exists. The price lists you'll find online are sales pages. What court and police records do show is the scale serious operations reach: more than 2,000 servers and 765,000 IP addresses for Methbot, 1,200 SIM boxes and 40,000 SIM cards for the network Europol dismantled.

Cheap to buy, costly to build, and profitable enough to keep building. That combination is why the market keeps growing.

Are Bot Farms Illegal?

Owning devices and running automation is legal. Bot farms break the law through what they do: ad fraud, fake reviews, fake influence and ticket bots.

There is no US law against owning a thousand phones. There are several against the jobs bot farms are hired for.

The FTC rule matters most to marketers, because it reaches buyers as well as sellers. It bans buying or selling fake indicators of social media influence, such as bot followers or views, when the buyer knew or should have known they were fake. It also bans buying fake reviews. In practice, an agency that buys followers to make a client look bigger is taking a legal risk, not just a reputational one.

Prosecution is still uneven. Many operators live in countries that rarely extradite, and proving who ordered which clicks is hard. But it happens: Methbot's operator was arrested in Bulgaria and tried in Brooklyn.

This section is a summary for marketers, not legal advice.

Where Are Bot Farms Located?

Bot farms run wherever hardware, SIM cards and labor are cheap, and many route their traffic through connections inside the country they target.

The sellers NATO's researchers bought from were based in Russia and Europe in 2019, and in Russia, India and Nigeria in 2022. Physical farms tend to sit where wages are low and fraud enforcement is weak.

But location tells you less than it used to. Server farms can run from anywhere, and rented home connections let a farm abroad look like a suburb in Texas. Methbot's servers sat in Dallas and Amsterdam while presenting themselves as US households.

Some operations set up inside the target country itself. In September 2025 the US Secret Service found more than 300 SIM servers and 100,000 SIM cards across the New York area, all within 35 miles of the United Nations, where the General Assembly was meeting. The agency was investigating threats to senior US officials, not ad fraud, but the hardware is the same kind that powers account farms.

Europol describes the supply chain behind this: people travel to countries where SIM cards can be bought in bulk with little or no registration, then ship them to wherever the farm runs.

If you're seeing a sudden surge from one region, we cover a common case in why your site is getting flooded with bot traffic from China and Singapore. Location filters help, but on their own they won't stop a farm that rents local connections.

How Can You Spot Bot Farm Traffic in Your Ads and Analytics?

Bot farm visits look normal one at a time. Spot them in patterns: paid sessions with no engagement, odd-hour bursts, and clicks that never convert.

Look across many sessions, not one. Here's where to look.

Signs in GA4

A bot that clicks your ad arrives with the ad's click ID, so GA4 files it under your paid channel, not Direct. Start in Acquisition, Traffic acquisition, and compare your paid rows against everything else.

• Paid sessions that aren't engaged. GA4 counts a session as engaged when it lasts more than 10 seconds, fires a key event or views two or more pages. A paid source whose engagement rate sits far below your other sources deserves a closer look.
• Bursts at odd hours. Real audiences follow daily rhythms. Farms run whenever the script is scheduled.
• Cities you never target. A new cluster of sessions from a city or country outside your targeting is a classic sign.
• Identical journeys. Many sessions with the same landing page, the same time on page and the same next click.

Bots that run JavaScript fire your tags, so GA4 counts them as users and sessions. Its built-in filter removes only known bots, so farm traffic usually stays in your reports. Our guide to what bot traffic is explains how it ends up in your numbers.

Signs in Your Ad Platforms

• CTR rising while conversion rate falls. More clicks, no more sales.
• CPA rising without a change on your side. Bot clicks are billed, and bots never buy, so every one of them pushes your cost per purchase up.
• Placements or apps with clicks and no sales. Check placement reports on Display, Performance Max and Meta's Audience Network.
• Early-step goals that climb while sales stay flat. If a campaign optimizes for landing page views or add to carts, bots can supply those results.

We walk through the platform-specific checks in Google Ads click fraud and Facebook and Meta ad fraud.

Why Bot Farms Are Harder to Catch Than Simple Bots

A basic bot running from a cloud server is easy to catch. It comes from an obvious server address and behaves too precisely.

Bot farm traffic is different. The clicks come from real phones on mobile networks, or from servers disguised as homes. If staff are involved, the behavior is genuinely human. No single visit looks wrong.

The weakness of a bot farm is coordination: many devices running the same script, hitting the same targets, in the same time windows. That's why detection that compares visits with each other catches what checking one visit at a time misses. For a step-by-step method, see how to detect bot traffic.

Want a directional read on how much of your paid traffic is real? Run the free GA4 check. Read-only, nothing to install.

How Can You Protect Your Ad Budget From Bot Farms?

Narrow your targeting, exclude placements that send clicks but no sales, optimize on purchases, and check paid traffic against organic every month.

No single setting stops a bot farm, because farms are built to slip past single checks. Stack these instead.

Tighten Your Targeting

In Google Ads, target people in or regularly in your locations rather than people showing interest in them. Cut countries and cities that never produce customers. The fewer places a campaign can serve, the fewer farms it meets.

Exclude Placements That Don't Sell

Review placement and app reports every month. Exclude the sites and apps that send clicks with no sales, and question networks that add volume without adding buyers, such as Search Partners on Search campaigns and Audience Network on Meta.

Treat IP Exclusions as a Patch

IP exclusion lists help against a repeat offender, but farms rotate addresses constantly. Use them for the obvious cases, not as your main defense.

Optimize on What Bots Can't Fake

Bots can fire a page view, a view content event and sometimes an add to cart. They never complete a purchase. Optimizing on purchases or qualified leads, rather than early steps, keeps the bidding from counting bots as results. You still pay for every bot click, but the algorithm stops chasing more of them.

Compare Paid Against Organic Every Month

If organic visitors average two minutes and three pages while one paid source averages eight seconds and one page, something is off. Track it month over month. Farm attacks often come in waves, and catching a wave early limits the damage.

Keep the Evidence

Google Ads and Microsoft Advertising accept invalid-click investigation requests for clicks within about 60 days. Records of which paid clicks were bots, by source and campaign, support a claim. The platform decides any credit.

Use Detection That Looks Across Visits

Coordination is a bot farm's weak point, so the layer that matters is detection that scores every visit and compares visits against each other. When you evaluate tools, ask whether they show bot share by source and campaign, so you know which sources to cut. Our roundup of click fraud software compares the options.

Hyperguard flags bot farm clicks in real time, by source and campaign, so you cut the sources that send them and put that budget into campaigns that really sell. Run the free GA4 check first, then see how Hyperguard works.