What Is a Bot Farm? Bot Farms, Troll Farms and Sockpuppet Accounts Explained

6 hours ago

11 min read

In short: A bot farm is an operation that runs large numbers of automated or semi-automated fake accounts to make messages look popular. A troll farm does the same with paid people posting under fake identities. Both are used for propaganda, fraud and fake engagement. Debunk.org has documented bot networks pushing pro-Kremlin content in the Baltic states and Poland.

Learn to detect coordinated fake accounts: start FIMI 101 → debunkacademy.org Get new investigations by email → debunk.org/subscribe

Also known as: bot network, botnet (social media), troll factory, troll army, click farm (commercial), sockpuppet network, coordinated inauthentic behaviour (CIB).

Key facts

A bot farm runs many automated or semi-automated fake social media accounts; a troll farm employs people to post under fake identities.
In July 2024, the US Department of Justice disrupted a Russian bot farm: it seized two domains and searched 968 X accounts, which X suspended.
Russia's Internet Research Agency, the best-known troll farm, had a monthly budget of over 1.25 million US dollars by September 2016, according to a US indictment.
In a 2022 NATO StratCom COE experiment, researchers bought 1,225 fake comments, 6,560 likes, 15,785 views and 3,739 shares for €168.
Europol said in October 2025 that a SIM-card service dismantled in Latvia had been used to create more than 49 million online accounts.
Debunk.org analysis of the "Russkaya Litva" network, January 2021 – June 2022: almost 5,000 posts whose videos were viewed more than 63 million times, amplified by accounts most probably created with SIM cards.
Debunk.org and Alliance4Europe analysis of X, 4 March – 4 April 2025: 279 posts linked to the Doppelganger operation targeted Poland's presidential election.

Updated October 2026 · By Debunk.org, an independent non-profit that researches disinformation

Contents: What is a bot farm? · What is a troll farm? · How bot farms work · Russian and Chinese bot farms and troll farms: real cases · Real cases from Debunk.org's research · Do bot farms make money? · Bot farms in advertising fraud · Are bot farms illegal? · Sockpuppets and coordinated inauthentic behaviour · How to spot bot accounts and fake accounts: 10 signs · FAQ · Sources

What is a bot farm?

A bot farm is a set-up that creates and runs many fake social media accounts, mostly by software, to make content look more popular or widespread than it is.

Bot farms can be racks of phones, banks of SIM cards, or simply software that controls thousands of accounts from one computer. The US Department of Justice described a bot farm as "an enhanced software package which allows for the creation of false personas on social media". [1] The aim is volume: likes, shares, comments and followers that make a message look like it has public support.

The term is also used for commercial fake engagement, such as fake views, followers and ad clicks; this page focuses on bot farms used to manipulate public debate.

What is a troll farm?

A troll farm is an organisation that pays people to post under fake identities, usually to push political messages, harass critics or start arguments online.

	Bot farm	Troll farm
Who posts	Software, often with some human control	Paid people (sometimes helped by software and AI)
Typical output	Likes, shares, reposts, simple comments, at very high volume	Comments, posts, arguments and fake personas that look human
Strength	Scale and speed	Credibility in conversations
Best-known example	Meliorator, the AI bot farm disrupted by the US in 2024	Russia's Internet Research Agency (IRA)

Bot farms and troll farms often work together: trolls write the messages, bots amplify them. In practice the line is blurring, as AI lets software write the convincing comments that once needed people.

Get new investigations of fake-account networks by email. debunk.org/subscribe

Next: see how analysts trace networks like these, step by step, in our guide to OSINT techniques and free tools.

How bot farms work

Bot farms create accounts in bulk, give them fake identities, and then use them together to post, share and react on cue.

Accounts: created in batches, or bought ready-made. Phone numbers are needed to verify accounts, which is why SIM-card farms matter: in October 2025, Europol and Latvian police dismantled a SIM-card service that operated 40,000 SIM cards in about 1,200 SIM-box devices; Europol said more than 49 million online accounts had been created with it. Europol described it as a cybercrime service for fraud, phishing and extortion. [2]
Disguise: profile photos (stolen or AI-generated), invented biographies, and posts on harmless topics to look real.
Content: written by operators or, increasingly, generated by AI.
Amplification: accounts like, share and comment on the same posts within minutes, or reply to real users and journalists to pull them in.
Evasion: when accounts are suspended, new ones replace them.

The US-led advisory on Meliorator described it as "a covert artificial intelligence (AI) enhanced software package" for creating fictitious online personas at scale. [3]

Russian and Chinese bot farms and troll farms: real cases

The best-documented state bot and troll farms are Russian (the Internet Research Agency and the AI-powered Meliorator bot farm) and Chinese (the Spamouflage network).

Internet Research Agency (IRA), St Petersburg. In February 2018, a US grand jury indicted "thirteen Russian nationals and three Russian companies" over interference in the 2016 US election. The indictment says the IRA "employed hundreds of individuals" for "Project Lakhta" and that by September 2016 its monthly budget "exceeded 73 million Russian rubles (over 1,250,000 U.S. dollars)". [4] The US Senate Intelligence Committee counted over 61,500 Facebook posts, 116,000 Instagram posts and 10.4 million tweets from IRA accounts. [5] Former employees have described the work: one told The New York Times in 2015 that her quota over two 12-hour shifts was "five political posts, 10 nonpolitical posts and 150 to 200 comments on other workers' posts". [20] The IRA is sanctioned by the US (since March 2018), the EU (since February 2022) and the UK (since March 2022). [6]
Meliorator, 2024. On 9 July 2024, the US Department of Justice announced the disruption of a "Russian Government-Operated Social Media Bot Farm": it seized two domains and searched 968 accounts on X, which X suspended. According to the DOJ, development was led by an RT deputy editor-in-chief, and a Russian FSB officer's private intelligence organisation had access to it. [1][3]
Spamouflage, China. In August 2023, Meta removed 7,704 Facebook accounts, 954 Pages, 15 Groups and 15 Instagram accounts belonging to what it called "the largest known cross-platform covert influence operation in the world", active on more than 50 platforms and forums. Meta found "links to individuals associated with Chinese law enforcement" and described operators in "geographically dispersed" groups across China working to "a clear shift pattern", with breaks for lunch and supper, Beijing time. Despite its size, the network "struggled to reach beyond its own (fake) echo chamber". The name Spamouflage was coined by Graphika in 2019; Google's Threat Analysis Group tracks the network as DRAGONBRIDGE, "also known as 'Spamouflage Dragon'", and found its engagement "almost entirely inauthentic, coming from other DRAGONBRIDGE accounts". [14][16] In May 2024, OpenAI reported that Spamouflage used AI to write entire fake "conversations" of replies, "likely to create the false impression that real people had engaged". [15]
A "troll factory" plan for Latvia. Leaked documents from Russia's Social Design Agency, reported by Re:Baltica in October 2024, set targets for July and August 2022 "to create 8–10 social media posts and 40–60 comments daily" about Latvia. These were planned targets, not measured output. [7]

Troll farms and paid commenters beyond Russia and China

State-linked and commercial "troll armies" have been documented in many countries.

China's "50-cent party": a 2017 study estimated that the Chinese government "fabricates and posts about 448 million social media comments a year". [17]
A commercial company in Israel: in May 2024, OpenAI reported that STOIC, "a commercial company in Israel", used its models to generate comments about the Gaza conflict, Israeli trade unions and the Indian elections; OpenAI named the operation "Zero Zeno" for its low engagement. [15]
Türkiye and Iran: Meta's August 2023 report also covered networks originating in Türkiye and Iran, removed under its coordinated inauthentic behaviour policy. [14]

Real cases from Debunk.org's research

Debunk.org has documented bot amplification of pro-Kremlin content in the Baltic states and Poland.

Case	What Debunk.org found
"Russkaya Litva" (Russian Lithuania) network, Jan 2021 – Jun 2022	Almost 5,000 posts promoting the "Russian World" idea; videos viewed more than 63 million times; a Lavrov video with 73,000 reactions whose popularity Debunk.org assessed as "inauthentic"; the amplifying accounts were "most probably created with SIM cards". [8]
Doppelganger and Poland's 2025 presidential election (with Alliance4Europe)	279 posts on X between 4 March and 4 April 2025, with 1,547,221 views according to X's own data (the report notes X's figures did not match what researchers saw manually). [9]

Our Doppelganger profile explains how bot networks amplified its cloned news sites.

Do bot farms make money?

Yes: selling fake engagement is a commercial business, and state operations also buy it.

In a 2022 experiment, the NATO Strategic Communications Centre of Excellence paid €168 to commercial manipulation services and "received… 1225 comments, 6560 likes, 15,785 views, and 3739 shares". More than 93% of the 27,309 fake engagements were still online four weeks later. The researchers called the industry "possibly… a billion-dollar industry". [10]

Commercial bot farms also make money from ad fraud (fake clicks and views on adverts) and from renting out accounts and phone numbers.

Bot farms in advertising fraud (click farms)

In advertising, "bot farm" or "click farm" means fake traffic: bots or racks of phones that view and click ads so that advertisers pay for audiences that don't exist.

Fraudsters earn money when advertisers pay per view or click. In the US "Methbot" scheme, prosecutors said the operators "rented more than 1,900 computer servers housed in commercial datacenters", made them imitate human browsing ("using a fake mouse to move around and scroll down a webpage") and caused losses of "more than $7 million for ads that were never actually viewed by real human internet users". A related scheme, "3ve", used "more than 1.7 million infected computers". [18] Physical click farms exist too: in 2017, Thai police raided a farm with 474 iPhones and 347,200 SIM cards, according to the Bangkok Post. [19]

The same infrastructure (fake accounts, phones, SIM cards) can be rented for political manipulation, which is why researchers study both.

Are bot farms illegal?

Running fake accounts usually breaks platform rules; whether it breaks the law depends on the country and on what the accounts are used for.

Platform rules: all major platforms ban fake and coordinated inauthentic accounts and remove networks they find.
Sanctions and criminal law: in the Meliorator case, the US Department of Justice said the FSB's use of US-based domains "violates the International Emergency Economic Powers Act" and that the payments violated money-laundering laws. [1]
EU: the Digital Services Act does not make running a bot farm an offence, but it requires the largest platforms to assess and reduce risks from manipulation "including by inauthentic use or automated exploitation of the service". [11]

This is general information, not legal advice.

Sockpuppets and coordinated inauthentic behaviour

A sockpuppet is a fake online identity used to deceive; coordinated inauthentic behaviour (CIB) is when networks of such accounts work together to manipulate debate.

Merriam-Webster defines a sock puppet as "a false online identity used for deceptive purposes". [12] Meta defines coordinated inauthentic behaviour as "coordinated efforts to manipulate public debate for a strategic goal, in which fake accounts are central to the operation". [13] Meta reported in December 2024 that Russia was the top source of such networks, with 39 disrupted since 2017. [13]

A sockpuppet can be one person's extra account; a bot farm or troll farm is a sockpuppet operation at industrial scale.

How to spot bot accounts and fake accounts: 10 signs analysts use

No single sign proves an account is fake; analysts look for several signs together, across many accounts.

Created in batches: many accounts opened on the same days, often recently.
Odd profile photos: stolen pictures (find them with a reverse image search) or AI-generated faces with blurred backgrounds and mismatched earrings or glasses.
Name changes: the account's name or language changed, sometimes several times.
Copy-paste posting: the same text, link or image from many accounts within minutes.
Office-hours activity: posting that follows one working day and one time zone, whatever the account claims about itself.
Followers that don't fit: an account about local politics followed mostly by accounts from the other side of the world.
Cross-platform seeding: the same content appearing on Telegram, X and Facebook in quick succession to look independent.
Thin history: few original posts, mostly reposts, and sudden bursts on one topic.
Follows many, followed by few: the account follows hundreds or thousands of accounts but has few followers of its own.
Hashtag and link stuffing: posts packed with hashtags or the same links, to game trends and search.

Free tools such as reverse image search and platform transparency pages help with several of these checks; see our guide to OSINT techniques and free tools. Analysts then describe the behaviour in a shared language, such as the DISARM framework, and judge its reach with the Breakout Scale.

Learn to investigate fake-account networks. FIMI 101 teaches the open-source checks and frameworks analysts use, with real cases. → Start FIMI 101

FAQ

What does bot farm mean? An operation that runs many automated or semi-automated fake accounts to make content look popular.

What is a bot, in simple terms? Software that runs an online account and posts, likes or replies automatically, without a person typing each action.

What is the difference between a bot farm and a troll farm? Bot farms rely mainly on software; troll farms on paid people posting under fake identities. Many operations use both.

Is having a bot farm illegal? It breaks the rules of all major platforms. It can also break the law, for example when it violates sanctions, fraud or election laws, depending on the country.

Do bot farms make money? Yes. Fake engagement is sold commercially; a 2022 NATO StratCom COE test bought over 27,000 fake engagements for €168.

What does "troll" mean online? Someone who posts deliberately annoying or offensive messages to upset people, get attention or cause trouble (after the Cambridge Dictionary). A troll farm turns this into paid, organised work under fake identities. [21]

What is a sockpuppet account? A false online identity used to deceive, for example to praise oneself or attack critics while appearing to be someone else.

What is coordinated inauthentic behaviour? Meta's term for networks of fake accounts working together "to manipulate public debate for a strategic goal".

Written by Debunk.org. Updated October 2026. Debunk.org is an independent non-profit that researches disinformation and FIMI and an EU Digital Services Act trusted flagger.

Sources

US Department of Justice, Justice Department Leads Efforts Among Federal, International, and Private Sector Partners to Disrupt Covert Russian Government-Operated Social Media Bot Farm, press release 24-850, 9 July 2024. https://www.justice.gov/archives/opa/pr/justice-department-leads-efforts-among-federal-international-and-private-sector-partners (read via an archived copy, 23 Oct 2026)
Europol, SIMCARTEL operation, press release, 17 October 2025 (action day in Latvia, 10 October 2025). https://www.europol.europa.eu/media-press/newsroom/news/cybercrime-service-takedown-7-arrested
FBI, Dutch AIVD/MIVD, Canadian Cyber Centre and partners, joint cybersecurity advisory on Meliorator, 9 July 2024, p. 1. https://www.ic3.gov/CSA/2024/240709.pdf
US Department of Justice, Grand Jury Indicts Thirteen Russian Individuals and Three Russian Companies…, 16 February 2018; indictment, United States v. Internet Research Agency LLC et al., pp. 6–7. https://www.justice.gov/archives/opa/pr/grand-jury-indicts-thirteen-russian-individuals-and-three-russian-companies-scheme-interfere
US Senate Select Committee on Intelligence, Report on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election, Volume 2, October 2019. https://www.intelligence.senate.gov/sites/default/files/documents/Report_Volume2.pdf
US Treasury, press release SM0312, 15 March 2018, https://home.treasury.gov/news/press-releases/sm0312; Council Implementing Regulation (EU) 2022/260, 23 February 2022, entry 52, https://eur-lex.europa.eu/eli/reg_impl/2022/260/oj; UK sanctions list ref. RUS0706, 15 March 2022.
Re:Baltica, Confrontation with Russia leads to poverty: how a Russian troll factory planned to turn public opinion in Latvia, 8 October 2024. https://en.rebaltica.lv/2024/10/confrontation-with-russia-leads-to-poverty-how-a-russian-troll-factory-planned-to-turn-public-opinion-in-latvia/
Debunk.org, Bot accounts spread the vision of the "Russian World" on social media platforms, 8 February 2023. https://www.debunk.org/bot-accounts-spread-the-vision-of-the-russian-world-on-social-media-platforms
Alliance4Europe and Debunk.org, report on Doppelganger activity targeting Poland's presidential election, 17 April 2025. https://alliance4europe.eu/?p=11746
NATO Strategic Communications Centre of Excellence, Social Media Manipulation 2022/2023, pp. 5 and 14. https://stratcomcoe.org/publications/download/Social-Media-Manipulation-2022-2023-DIGITAL.pdf
Regulation (EU) 2022/2065 (Digital Services Act), Article 34(2) and recital 84. https://eur-lex.europa.eu/eli/reg/2022/2065/oj
Merriam-Webster, "sock puppet". https://www.merriam-webster.com/dictionary/sock%20puppet
Meta, Adversarial Threat Report, Q4 2024, February 2025, p. 3; Meta, 2024 global elections, 3 December 2024. https://about.fb.com/news/2024/12/2024-global-elections-meta-platforms/
Meta, Second Quarter 2023 Adversarial Threat Report, August 2023, pp. 3–9. https://transparency.meta.com/sr/Q2-2023-Adversarial-threat-report/ (saved, sha256); Ben Nimmo, C. Shawn Eib and L. Tamora, Spamouflage, Graphika, 25 September 2019.
OpenAI, AI and Covert Influence Operations: Latest Trends, May 2024, pp. 7–8. https://openai.com/index/disrupting-deceptive-uses-of-ai-by-covert-influence-operations/
Google Threat Analysis Group, Over 50,000 instances of DRAGONBRIDGE activity disrupted in 2022, 26 January 2023. https://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/
Gary King, Jennifer Pan and Margaret E. Roberts, How the Chinese Government Fabricates Social Media Posts for Strategic Distraction, Not Engaged Argument, American Political Science Review 111(3), 2017. https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf
US Attorney's Office, Eastern District of New York, Two International Cybercriminal Rings Dismantled and Eight Defendants Indicted for Causing Tens of Millions of Dollars in Losses in Digital Advertising Fraud, 27 November 2018. https://www.justice.gov/usao-edny/pr/two-international-cybercriminal-rings-dismantled-and-eight-defendants-indicted-causing (archived copy saved)
Bangkok Post, Fake likes probe turns to local operators, 12 June 2017. https://www.bangkokpost.com/thailand/general/1267202/fake-likes-probe-turns-to-local-operators
Adrian Chen, The Agency, The New York Times Magazine, 2 June 2015. https://www.nytimes.com/2015/06/07/magazine/the-agency.html
Cambridge Dictionary, "troll". https://dictionary.cambridge.org/dictionary/english/troll