Click Farms: How They Work and How to Spot Their Traffic in Your Stats

Bots give themselves away through their tech: a server IP, a browser without JavaScript, traces of automation. A click farm has none of that. It runs on regular smartphones, over regular mobile carriers, and quite often there is a real person behind the screen. In your click log such a visit looks like a buyer's visit, until you look at a hundred of them side by side.

Let's break down how click farms are built, why they are harder to catch than bots, and which signs give them away in your campaign stats.

What is a click farm

A click farm is an organized production line of ad actions. Farm workers click ads, watch videos, install apps, sign up and fill in forms, paid either by whoever ordered the fake activity or by the payouts of an affiliate program.

It is one of several types of ad fraud, alongside botnets, source spoofing and in-app fraud. The overall map of these schemes is in the article on types of ad fraud; here we focus on farms.

The key difference between a farm and a bot: the farm uses real devices. Not a smartphone emulated on a server, but hundreds of physical phones with real SIM cards, batteries and screens.

How click farms are built

There are many farms and they differ a lot. Roughly, they fall into four types.

Manual farms: people holding phones

The simplest and oldest setup. Workers sit in a room, each with several phones. They get a task: find the ad, click it, scroll the page, register. Everything is done by hand, so the taps, scrolls and pauses are genuinely human.

These farms are slow, but behavioral checks barely work against them: a person is a person. What gives them away is not a single visit but repetition: the same scenario, the same devices, the same hours.

Phone racks and automation

The next step is a phone farm: shelves holding dozens or hundreds of smartphones wired to one computer. The operator controls them in bulk, through a debugging interface, mass-control software or scripts that replay recorded taps.

There is less human and more automation here, but the devices are still real. The browser runs JavaScript, the fingerprint looks like an ordinary phone, and the IP comes from a mobile carrier. The weak spot is uniformity: phones are bought in batches, so it is one or two models on the same OS version.

Hybrid: a script with a human on standby

A script handles the routine: opening links, waiting, scrolling. When a captcha, an SMS confirmation or a meaningful form entry is needed, a human steps in. This setup is cheaper than a manual farm and more believable than pure automation.

Distributed farms and incentivized traffic

The hardest case is when the "farm" is not in one room at all. Tasks are handed out through reward apps: a person at home installs an app, signs up and gets a few cents or in-game currency for it. Devices vary, and IPs are home and mobile addresses from different cities.

Formally this traffic is human: the person is real and the phone is theirs. But they have no interest in your product and no intention to pay. For an advertiser paying for results it is as much junk as a bot.

Why farms click your ads

A click farm always has a client or a beneficiary. Most often it is:

• A dishonest placement or publisher. The more clicks and installs on their traffic, the more they earn from the ad network. The farm pads the volume.
• A publisher in an affiliate program. If the offer pays for sign-ups or installs without a quality check, the farm generates those actions directly.
• A competitor. Click fraud done by human workers slips past some simple protections. More on this in the article on competitor click fraud.
• Account and profile warming. Farms are used to build up "history" for accounts, and ad clicks appear as a side effect.

In every case you are the one paying: for the click, the impression, the install or the lead that will never be approved.

Why a farm is harder to tell apart from a bot

Most bot protection works on three levels: network, browser and behavior. A click farm passes all three better than a server-side bot.

• Network. A bot usually lives in a data center, and the hosting ASN gives it away. A farm connects through a mobile carrier or home ISPs. If the farm buys mobile or residential proxies, the picture gets even cleaner; see the article on residential and mobile proxies.
• Browser. A bot on a headless browser leaves automation traces, covered in the article on headless browsers and fingerprints. On a farm the browser is real, JavaScript runs and the fingerprint is consistent.
• Behavior. A live worker taps the screen, scrolls with inertia and pauses. Even an automated rack often replays recorded real gestures.

That is why you can almost never call a farm visit a "bot" on its own. A farm shows up in aggregate: when a hundred visits look more alike than a real audience ever does.

There is also the cost of a mistake. If you cut "suspicious" mobile networks too aggressively, real buyers on the same carriers get cut too. So what works against farms is not hard blocking but monitoring and targeted measures.

Click farm red flags in your stats

Below are the signs worth looking for in your click log and source reports. One sign proves nothing; three or four together on one source are a reason to dig in. The general list of automated traffic signs is in the article on bot traffic signs.

Identical devices

A real audience is diverse: dozens of phone models, different OS versions, browsers and screen resolutions. A farm is the opposite:

• one or two device models account for a disproportionate share of a source's visits;
• they all share one OS version and one browser version, often an outdated one;
• the same screen resolution, system language and time zone;
• cheap models that are rare among your target audience in that geo.

Compare not against some "general norm" but against your other sources in the same geo. If on average your most popular model accounts for a tenth of visits, and on one placement it is half, that is a signal.

Narrow IP ranges and the same networks

A farm in one building reaches the internet through a limited set of exit points. In the stats that looks like:

• lots of visits from one subnet, with addresses differing only in the last digits;
• one ISP or carrier behind most of the source's traffic, even though the geo has several;
• one city while you target the whole country;
• IPs with a bad history, already seen in fake activity. How to check an IP's history is covered in the article on IP reputation.

Mobile carriers hand out addresses through shared gateways, so one subnet on mobile traffic is normal by itself. It becomes a sign in combination: one subnet, one phone model, one time of day.

Unnatural conversion to sign-ups with no money

This is the most reliable sign, because it is economic. The worker is paid for a specific action and does exactly that:

• the sign-up CR is high, sometimes higher than on your best sources;
• conversion from sign-up to payment is close to zero: no deposits, purchases or subscriptions;
• the affiliate network rejects leads as "duplicate", "no answer" or "fake";
• sign-ups arrive in even batches instead of being spread through the day.

For incentivized installs the logic is the same: plenty of installs, almost no day-2 retention, no in-app events. For this sign to work you need second-level conversions: not only "sign-up" but also "payment", "approved" and "rejected". How to get them from the affiliate network is covered in the article on conversion statuses.

Odd timing and rhythm

A farm works in shifts. So:

• clicks come in dense bursts: ten minutes of activity, then silence;
• the intervals between clicks are too regular;
• activity ignores the geo's daily rhythm: as many clicks at local night as during the day;
• weekends look exactly like weekdays.

Behavior after the click

Even a live worker does not act like a buyer. They are not looking for information, they are following instructions:

• the same time on page across a large group of visits;
• the same path every time: landing page, form, submit, without opening other pages;
• forms filled with template data: similar names, emails on one domain, sequential phone numbers. More on such leads in the article on bots submitting forms;
• repeated sign-ups from one device under different details.

How to reduce the share of click farm traffic

You cannot remove farms from your traffic completely: some of their visits are indistinguishable from real ones. But you can push their share low enough that it stops deciding your campaign economics.

1. Find the source. A farm is almost always concentrated on specific placements, zones or sub-sources. Break the report down by source tags and compare sources against each other using the signs above.
2. Block placements in the network itself. A filter on your side protects the landing page and the stats, but you have already paid for the click. Placement blacklists in the ad account save money directly.
3. Optimize for a deep conversion. If the platform's algorithm learns from sign-ups, it will look for people who sign up, which means the farm. Send the payment or the approved lead to the ad account, not the first action.
4. Cap repeats. A daily click cap per IP and per device cuts off the crudest part of a farm without hurting real users.
5. Narrow device targeting carefully. If a farm runs on one outdated model, excluding it helps. But check that the model is not popular with your real audience in that geo.
6. Ask for refunds. Many networks and affiliate programs refund proven fraud. You need evidence: a click log with repeats, rejected leads, the gap versus other sources.
7. Raise the bar for the offer. Phone verification, a minimum amount, email confirmation: anything that is expensive for a worker and cheap for a buyer.

And measure what the farm costs you. Even a small fraud share on an expensive source hits ROI noticeably. How to turn the share of junk traffic into dollars is covered in the article on how much ad budget is lost to bots.

How ArtisanClo helps

ArtisanClo filters out bots, data center traffic, VPNs and proxies, and every click in the log shows the reason code behind the decision. A farm on real phones cannot always be told apart from a buyer on a single visit, so the second part, statistics, matters here. The click log shows the device, model, browser, network and carrier, so identical devices and narrow IP ranges on one placement can be found in a few minutes. A per-IP click cap and your own blacklist take care of repeats.

The built-in tracker accepts conversions with different statuses and calculates spend, conversions, profit and ROI by campaign and source. A source with high sign-ups and zero payments stands out in the report right away, without merging spreadsheets by hand.

Bottom line

A click farm is real phones, and often real people, performing ad actions with no interest in the product. Network and browser checks let it through because technically it is clean. What gives it away is the statistics: identical devices, narrow IP ranges, scheduled bursts and, above all, sign-ups with no money behind them. Fighting farms takes a combination rather than a single block: find the source in your reports, block the placement, optimize the campaign for a deep conversion, cap repeats and regularly measure how much money goes into this traffic.