Device farms
Physical warehouses of real phones, tablets, or computers wired together and operated in parallel. Each device looks legitimate at a hardware level, which makes simple fingerprint detection ineffective.
Ad Fraud Glossary · 2026
What is a bot farm?
A bot farm is a coordinated network of devices, software, or human operators that generates large volumes of automated or fraudulent traffic — fake clicks, fake views, fake form fills, fake account signups — usually to defraud advertisers, ad networks, or platforms.
How bot farms drain ad budgets
Bot farms exist because someone, somewhere, will pay for a click, a view, an install, or a form submission. That’s the entire business model. Operators run hundreds or thousands of devices in parallel, each producing the kind of activity an ad platform measures and pays out on. The advertiser’s spend leaves their account; the bot farm captures the payout via a publisher, affiliate, or app slot it controls.
Across 2 billion clicks analysed for the Opticks Ad Fraud Report 2025, 416,300,090 bot sessions were detected between January 2025 and March 2026. 89.10% were malicious — only 10.90% were legitimate crawlers.
The four types
Types of bot farms
Bot farms aren’t a single category — they vary in scale, sophistication, and what they’re built to fake.
Software bot farms
Servers running automated scripts at scale. They scale fastest and cheapest, but produce signals (headless browsers, identical user-agents, data-centre IPs) that good detection can spot.
Mobile bot farms
Specialised for app-install fraud and in-app activity — rooms of real phones cycling through installs, sessions, and in-app events to capture CPI and post-install payouts.
Click farms (human)
Rooms of low-paid workers clicking on ads, liking posts, and filling out forms. Hardest to detect because the activity is technically performed by a human — but behavioural patterns still give them away.
How bot farms operate
The economics are simple. An operator runs N devices producing M events per day. Each event has a payout: a click on Google Ads might be worth a fraction of a cent to the operator (via an affiliate or publisher arrangement), an app install might be worth several dollars, a filled lead form on a high-CPL B2B campaign might be worth more. Multiplied by scale, it works.
The most sophisticated farms invest in looking like real users: residential proxies to disguise IP origin, real device fingerprints, behavioural mimicry (mouse movements, scroll patterns, click timing). The Opticks Ad Fraud Report 2025 notes that the most advanced bots are now “almost indistinguishable from commercial browsers.”
That’s why simple defences — IP blocklists, user-agent filters, CAPTCHA — aren’t enough on their own.
How to detect bot farm traffic
Effective detection combines signals across three layers:
Network layer
IP reputation, ASN patterns, data-centre and VPN/proxy detection, residential proxy fingerprinting.
Application layer
Device and browser fingerprints, header consistency, JavaScript challenge response, telemetry presence.
User / behavioural layer
Click timing, mouse and scroll patterns, session shape, form-fill speed, conversion-path realism.
Combining detection layers
No single signal catches a sophisticated bot farm. Opticks combines all three layers with statistical, machine-learning, and heuristic rules, detecting more than 30 types of invalid traffic across paid and non-paid channels.
Source: Opticks Ad Fraud Report 2025 — 2 billion clicks analysed, 500+ advertisers, 243 territories, data through Q1 2026.
Frequently Asked Questions
See if bot farms are hitting your campaigns
Free Opticks traffic scan — 5 minutes to set up, real numbers on your real campaigns.
Start a free trial
No credit card required