What is a bot farm?
A bot farm is a pool of automated accounts operated together as one resource. The accounts have names, profile pictures, and plausible histories; what they do not have is anybody behind them making independent decisions. They exist to manufacture activity at a volume no individual could produce, on behalf of whoever is operating or renting them.
What bot farms produce
Whatever a platform counts, a bot farm can manufacture. On social products, that means followers, likes, and the appearance of consensus. On marketplaces, it means reviews and ratings. On SaaS products, it usually means bulk registrations created to consume free-tier resources, harvest trial credit, drain a promotional budget, or sit dormant until a buyer comes along.
The management runs it like an ordinary business, with pricing tiers and support. Accounts are stock, infrastructure is rented, and the customer is anyone with a metric they would like to look healthier than it is.
How bot farms avoid looking like one
Operators know exactly what basic detection looks for, and the entire setup is arranged to defeat it. Residential proxies give each account an apparently domestic connection in a plausible country. Registrations are staggered over days instead of fired in a burst. Profiles get different names, photos, and bios. Activity is paced to resemble human rhythms, complete with overnight gaps.
What survives is the coordination itself. Accounts under one operator share something: an egress range, a provisioning pattern, a behavioral template, or a device characteristic the automation failed to vary. The disguise is applied account by account; the tell appears in the population.
How Dregs finds coordinated accounts
Dregs scores each account across its accumulated history and links accounts through shared devices, networks, sessions, and behavioral similarity. A farm is therefore evaluated as a cluster rather than as several hundred unremarkable signups, because the cluster is where the pattern becomes visible.
The automation evidence feeds the Humanity score and the linkage feeds Uniqueness, with the identity graph holding the connections. Scores update moments after new activity arrives, and every one opens into its observations, so a flagged cluster comes with the evidence attached. That means less manual review, with an investigation taking minutes rather than an afternoon. Teams that recognize a particular farm's pattern can capture it in custom rules and lists so the next batch is caught on arrival.
Frequently Asked Questions
Q: What is the difference between a bot farm and a botnet?
A: A botnet is made of compromised machines: computers or devices infected with malware and controlled without their owners' knowledge, typically used for distributed attacks or spam relaying. A bot farm is made of accounts, and the infrastructure behind it is usually rented rather than stolen. The overlap is that a bot farm may use botnet-supplied residential proxies to make its accounts appear to come from ordinary home connections.
Q: Is a bot farm the same as a troll farm?
A: They are related but not identical, and the terms get used loosely. A troll farm is defined by its purpose, which is coordinated influence, and it is often staffed by people rather than software. A bot farm is defined by its automation. A given operation may be both. For anyone running a product rather than a newsroom, the operationally useful definition is the automation one: a pool of accounts acting under single control.
Q: How do you detect a bot farm?
A: Through coordination rather than through any individual account. Farm accounts share infrastructure, get created in bursts, follow templated profile patterns, and act with a synchrony that unrelated people never manage. Any one account may look ordinary; the population does not. Detection therefore depends on linking accounts to each other and scoring the cluster rather than examining registrations one at a time.
Further Reading
Detect coordinated bot farms on your site.
Dregs helps you detect coordinated bot farms across your free tier, signup flow, and user base. It evaluates linked clusters across device, network, and behavior, exposing farm accounts even when each registration looks ordinary on its own.
Schedule a Demo