A bot farm is a coordinated network of devices, whether physical phones racked in a warehouse or virtual machines spun up in the cloud, used to generate fake online activity on a large scale. For fraud teams, that activity rarely stops at fake ad clicks. Fraudsters use bot farms to create fake accounts, test stolen credentials, hoard inventory, and manufacture the fraud infrastructure that fuels everything downstream.
What is a bot farm?
A bot farm is a centralized network of software, automated scripts, or physical devices that are designed to create fake online engagement or perform the same actions thousands or even millions of times. Bot farm operators run four different types of bot farms:
- Device farms which feature real physical phones or tablets
- Software bot farms that run automated scripts on servers
- Mobile bot farms that are built for app installation fraud
- Click farms staffed by low-paid human workers
To correctly detect one, you need to be able to distinguish between the type of bot farm you’re dealing with. A software bot leaves obvious fingerprints, since it doesn’t involve a physical camera, no accelerometer data, and features an identical screen resolution across all of the sessions. On the other hand, a device farm that’s running on real smartphones with real SIM cards looks, at least on a hardware level, exactly like a legitimate customer. Bot farms are appealing to fraudsters because they can slip past fraud filters built around device fingerprinting alone.
How fraud teams see bot farms in the wild
Trust and Safety professionals encounter bot farms most often at account creation and login. Fraudsters use them to mass-produce accounts for later resale, to test stolen credentials against login pages, and to claim signup bonuses and promo codes repeatedly. Marketplaces, ticketing platforms, and social platforms are frequent targets because each new account or listing has resale value.
Recent vendor telemetry shows the scale of the problem. Bot attack research aggregating data from Imperva and Arkose Labs found that fake account creation was the leading attack type across the industries studied in late 2025, and that scraping, payment fraud, account takeover, and scalping together made up the bulk of bot-driven API abuse. Travel and hospitality, retail, and ticketing platforms were disproportionately targeted, a pattern consistent with what Sift customers in marketplaces and e-commerce report.
Ticketing offers one of the clearest examples of bot farm mechanics. In mid-2026, DataDome documented a scalping operation that used a purpose-built CAPTCHA-solving farm to attempt 18.8 million ticket purchases across 3.2 million IP addresses and more than 22,000 autonomous systems. The operation never tried to overwhelm the platform with raw request volume; instead, it distributed activity across so many devices and networks that individual sessions looked unremarkable.
Why bot farms are getting harder to detect
Bot farms have only gotten more challenging to detect over time because bot farm operators have adapted to signature-based defenses. Instead of scripting a browser to click through a form, modern operations run on real hardware with genuine sensors and carrier connections with behavior patterns copied from real user sessions. CHEQ’s 2026 network data found that automation tools, not the classic scripted bots that IP-blocking was designed to catch, are now the largest category of invalid traffic by volume, even as the total amount of malicious bot traffic has increased.
This shift means fraud teams can’t just rely on one signal to spot bot farms. A device that passes a fingerprint check might still be part of a farm if its account creation velocity, geographic distribution, and behavioral timing match thousands of other sessions. Detecting bot farms increasingly requires correlating several signals across a network of accounts and devices rather than evaluating each session by itself.
Geography adds another layer of difficulty. Bot farm operations concentrate in regions where device and labor costs are low, including parts of Southeast Asia, Eastern Europe, and South America, and then route traffic through residential proxy networks so the geographic footprint of any single session looks unremarkable. A fraud team looking only at country-level risk scoring will miss a farm that has deliberately spread its accounts across dozens of plausible locations.
What effective bot farm detection looks like
Because bot farms are made to beat any single check, defense against them needs to be layered. Effective programs combine:
- Device and behavioral signals that catch anomalies invisible at the individual session level, such as identical typing cadence or scroll patterns repeated across accounts that otherwise look unrelated.
- Network-level analysis that groups accounts, devices, and transactions by shared infrastructure, since bot farms concentrate traffic through proxy pools or data center ranges even when individual sessions are randomized.
- Velocity and pattern monitoring at account creation, since a farm’s entire value proposition depends on producing large numbers of accounts quickly.
- Cross-merchant intelligence, since a bot farm rarely targets one platform. The Fraud Economy runs on shared infrastructure, and a network flagged on one site is often already active somewhere else.
How fraud teams can prioritize response
Not every bot signal requires the same level of friction. A new account showing mild automation indicators might warrant step-up verification rather than an outright block, while a cluster of accounts sharing device fingerprints, IP ranges, and creation timing at scale is a stronger signal for immediate action. Applying friction based on risk level lets teams scrutinize each case on its own merits rather than treating all suspicious signups exactly the same, preserving the experience for trusted users while still slowing down coordinated abuse.
Fraud analysts should also expect bot farm operators to test a company’s defenses continuously. An operation that gets blocked on one signal will often return within days using a different device profile or a new proxy pool. Treating bot farm defense as a one-time integration rather than an ongoing program is one of the most common reasons for detection accuracy degradation over time. Reviewing blocked and flagged traffic on a regular cadence and feeding confirmed bot activity back into detection models keeps pace with an adversary that adapts quickly.
If your team is seeing signs of bot farm activity, Sift can help. Sift uses machine learning to correlate signals across billions of events, spotting coordinated bot activity even when it’s spread across thousands of devices and IPs. That means catching account creation fraud and credential testing before they turn into losses further downstream. Read more about it here.
Frequently asked questions
What is the difference between a bot and a bot farm?
A single bot is one automated script or program performing a task. A bot farm is a coordinated network, often made up of thousands of devices or accounts, working together under one operator to produce fraud on a large scale.
Can bot farms be detected through IP blocking alone?
Rarely, and less so every year. Bot farms distribute activity across large proxy networks and residential IP ranges specifically to defeat IP-based blocking, so effective detection depends on behavioral and network-level signals in addition to IP reputation.
Which industries are most affected by bot farms?
Ticketing, marketplaces, travel, retail, and social platforms see the heaviest bot farm activity, largely because accounts, listings, and inventory on these platforms carry direct resale value.
