What Is a Bot Farm? Types, How They Work and How to Stop Them

A bot farm is a coordinated network of devices, software, or paid workers, run by one operator, that produces fake online activity at scale: fake ad clicks, fake views, fake account sign-ups, fake followers, and fake form fills. Bot farms exist because someone pays for each of those actions. To stop bot farm traffic, check the network, the device, and the behavior behind each visit together, and keep whatever gets through out of your CRM and your ad conversions.

If you're dealing with bot farm traffic at volume, GoodInbound Lead Screen is a drop-in fix for the form fills it produces. It screens how every visitor fills in your form and stops automated list bombing, spam, and non-buyers sending unsolicited pitches from cluttering your pipeline, with five layers of protection:

• Rules: domains you always accept or always block.
• Behavior: how the form was filled in: typing, pasting, fill time, automation tells, and a built-in honeypot.
• Network: data centers, VPNs, proxies, Tor, and bursts from one IP or device.
• Identity: whether the email has a working inbox and isn't disposable or gibberish, and whether the phone number is real.
• Message: the whole submission read for intent, so sales pitches, recruiters, and link offers are caught.

Every submission is classified into five types (lead, review, spam, junk, and bot), and only the real leads, based on your filters, are reported to Meta, TikTok, and Google Ads. GoodInbound takes care of the entire flow end to end for you.

Use GoodInbound for free for up to 500 screened submissions a month.

What is a bot farm?

A bot farm is many bots, or many people acting like bots, working together under one operator to repeat the same action thousands or millions of times. A single bot is one script doing one job. A bot farm is the operation around it: the devices or servers, the accounts, the SIM cards, the proxy networks that hide where the traffic comes from, and the software that tells every unit what to do next.

What a bot farm fakes depends on who is paying:

• Ad clicks and impressions, so a publisher, app, or affiliate collects money from an advertiser.
• Form fills and leads, where a campaign or an affiliate deal pays per lead.
• App installs and in-app events, where an app marketer pays per install.
• Accounts, created in bulk to resell, to claim sign-up bonuses, or to test stolen passwords.
• Likes, follows, views, and comments, to make an account or a message look more popular than it is.

Types of bot farms

Bot farms differ in what they are built from, and that decides how hard they are to spot.

Device farms

Racks of real phones, tablets, or computers, wired together and driven by scripts. Each device has real hardware, a real screen, and often a real SIM card, so checks that only look at the device see nothing unusual.

Software bot farms

Servers running automated browsers and scripts. They are the cheapest to run and the fastest to scale. They also leave the clearest marks: data center IP addresses, browsers with no screen, and the same browser version and screen size repeated across thousands of visits.

Mobile bot farms

Device farms built for app fraud. Phones cycle through installing an app, opening it, and triggering in-app events, so the operator collects per-install payouts.

Click farms

Rooms of low-paid workers who click ads, like posts, and fill in forms by hand. The activity is performed by a person, so it passes anything that only asks "is this a human?". The patterns still give it away: the same devices and networks, the same routine, at a pace no interested buyer keeps up.

Bot farm vs. click farm vs. troll farm vs. botnet

The four terms overlap, and people use them loosely. This is how they differ.

The main difference between a bot farm and a botnet is ownership. A bot farm runs on equipment the operator controls. A botnet runs on devices that belong to people who don't know they are part of it. Both are used for ad fraud.

How bot farms work

The business model is simple. An operator runs a number of devices, each producing a number of paid events a day. A click may be worth a fraction of a cent to the operator, an app install a few dollars, and a completed lead form on an expensive campaign more than that. Multiplied across thousands of devices, it adds up.

Most of the work goes into looking like real, separate people:

• Residential and mobile proxies route each visit through an ordinary home or phone connection, so the traffic doesn't come from a data center and doesn't share an IP address.
• Real or copied device fingerprints make each visit report a different, believable phone or browser.
• Scripted behavior adds mouse movement, scrolling, pauses, and typing at a human pace.
• Rotation spreads activity across so many devices, accounts, and locations that no single one stands out.

That last point is why a bot farm is harder to catch than a single bot. It doesn't flood a site from one place. It sends a small, plausible amount of activity from a great many places.

How do bot farms make money?

Bot farms make money by collecting payouts that were meant for real customers' attention, or by selling the fake activity directly:

• Ad fraud. The operator owns or partners with a site, app, or affiliate link, sends fake visitors to click the ads on it, and keeps the publisher's share of what the advertiser paid.
• Lead and affiliate fraud. Where an advertiser pays per lead or per sign-up, the farm submits forms with made-up or stolen details and collects the bounty.
• Selling engagement. Followers, likes, views, reviews, and comments are sold in bulk to anyone who wants to look popular.
• Selling or using accounts. Accounts created in bulk are resold, used to claim promotions over and over, or used to test stolen passwords.

Large operations have been prosecuted. Methbot ran data center servers that posed as people watching video ads and cost advertisers more than $7 million; its operator was sentenced to 10 years in prison in 2021 (US Department of Justice). A related scheme, 3ve, used more than 1.7 million malware-infected computers and caused businesses to pay more than $29 million for ad views no person made (DOJ).

What bot farms cost advertisers and lead forms

The first cost is the obvious one: you pay for clicks and views nobody saw. The second is usually larger, and it starts when bot farm traffic reaches a form.

• Fake leads in your CRM. Sales time goes into calling numbers that don't connect and emailing inboxes that don't exist.
• Fake conversions in your ad account. Each fake form fill counted as a conversion tells Google or Meta that this kind of visitor is what you want. Bidding then goes looking for more of them. See fake leads from Facebook and Google ads.
• Wrong numbers everywhere else. Conversion rates, cost per lead, landing page tests, and audience lists all get built on visits that weren't people.

Are bot farms illegal?

Running many devices or scripts is not illegal in itself. Automated testing, for example, uses the same tools. What the farm is used for decides it. Faking ad traffic to take advertisers' money is fraud, and large cases have been prosecuted as wire fraud and money laundering, as Methbot was. Creating fake accounts breaks every major platform's terms, and platforms remove the networks they find.

In practice, most bot farms run from places where enforcement is unlikely, and a small advertiser has no realistic legal route against one. The practical defense is detection: spot the traffic, keep it out of your data, and ask the ad platform for credits where it applies.

How to detect bot farm traffic

No single signal catches a well-run bot farm, because each one is built to pass any single check. Detection works when you combine three layers.

Network layer

Where the visit came from: whether the IP belongs to a data center, a VPN, a proxy, or Tor, and whether many visits arrive from the same network range or the same handful of addresses in a short time.

Device and browser layer

What made the request: signs of an automated browser, a device fingerprint that appears again and again, or details that don't fit together, such as a phone browser reporting a desktop screen.

Behavior layer

What the visitor did: how long they spent on the page, whether they scrolled, how fast the form was filled in, whether text was typed or pasted in one go, and whether the path from ad click to submission looks like someone reading or something executing steps.

On your own site, these are the patterns worth checking:

• Ad clicks rise while engaged visits and real leads stay flat.
• One IP address or one ad click ID (the GCLID on Google Ads) arrives from your ads many times in a few hours.
• Form fills land seconds after the page loads, or at a steady rhythm through the night.
• Leads share details: the same phone prefix, the same email pattern, near-identical messages.
• Traffic comes from placements you didn't pick, such as app and display partner inventory.

What is bot traffic? covers how to run these checks in your logs and analytics.

How to stop bot farm traffic

You can't switch a bot farm off, so the aim is to stop paying it and stop it teaching your campaigns the wrong thing.

1. Cut the placements that send it. Exclude app and display partner placements that produce clicks without leads. For Meta, see Meta Audience Network.
2. Exclude repeat offenders. Google Ads lets you exclude IP addresses at the campaign level. It helps against the clumsy end of the problem, and not against farms that rotate through residential proxies.
3. Screen every form submission. Check the behavior, network, and identity behind each fill before it reaches your CRM. This is the point where a bot farm's fake lead becomes your problem, and it's the point you fully control.
4. Send only real leads back as conversions. Report a conversion to Google or Meta after the lead has been checked, and not when the form is submitted. How to keep spam leads out of Google Ads conversions walks through the setup.
5. Ask for credits. Google credits invalid clicks it confirms, and you can request an investigation.

GoodInbound handles steps 3 and 4. Lead Screen labels each submission, and click fraud protection tracks visits that arrive from your ads by campaign, flags IPs that come back 5 or more times in 2 hours and click IDs that land 3 or more times in a day, and reports only accepted leads to your ad platforms.

FAQ

What does bot farm mean?

A bot farm is a large group of automated devices or accounts, run by one operator, that repeats an action to fake online activity: clicks, views, sign-ups, followers, or form fills. The "farm" refers to the scale and the setup, often racks of phones or servers running the same scripts.

What is the difference between a bot and a bot farm?

A bot is one automated program doing a task. A bot farm is a coordinated network of them, often thousands of devices or accounts, working together under one operator so the activity looks like it comes from many separate people.

Are bot farms real?

Yes. They range from one person with a few dozen phones to operations with thousands of servers. Methbot and 3ve, both prosecuted in the United States, are the best-documented examples in advertising.

How do bot farms make money?

They collect payouts for fake activity. The most common routes are ad fraud (fake clicks and views on ad space the operator profits from), lead and affiliate fraud (fake form fills where each lead is paid for), and selling followers, likes, reviews, or ready-made accounts in bulk.

Is having a bot farm illegal?

Owning the equipment isn't. Using it to fake ad traffic, submit fraudulent leads, or break into accounts is, and large schemes have been prosecuted as wire fraud. Fake accounts also break the terms of every major platform.

Can you block bot farms by IP address?

Only the simplest ones. Bot farms spread their traffic across residential and mobile proxy networks so no IP address shows up often enough to block. IP reputation is still useful as one signal, alongside device and behavior checks.

How do I know if bot farm traffic is hitting my ads?

Compare clicks, engaged visits, and real leads for each campaign and placement. A source with rising clicks, almost no engagement, and leads your sales team can't reach is the usual pattern. Repeat visits from the same IP or the same click ID within hours are another sign.

How do I stop bot farms from filling in my forms?

Screen each submission on how it was filled in, the network it came from, and whether the email and phone are real, then keep anything labeled bot, spam, or junk out of your CRM and your ad conversions. GoodInbound Lead Screen does this on the form you already have with one script tag.