A bot farm is a network of compromised devices controlled remotely, usually without the owner's knowledge. A device farm is a rack of real phones, operated by a human or a script, that behaves like a legitimate user because the hardware is legitimate. The tells are different: a bot farm shows up in the device fingerprint, the IP reputation, and the behavior at scale. A device farm shows up in the economics, the timing, and the uniformity of the devices. BADBOX 2.0, disclosed by Google in July 2025, compromised more than 10 million uncertified Android devices, and the 911 S5 proxy service, dismantled by the DOJ in May 2024, controlled more than 19 million IP addresses.
BADBOX and the compromised device
BADBOX 2.0 is the largest bot farm disclosed in recent years. Google's Threat Intelligence Group reported in July 2025 that more than 10 million uncertified Android devices, mostly low-cost TV boxes and tablets, were infected with the BADBOX malware, which turns the device into a residential proxy, an ad fraud node, and a credential stuffing platform. The devices were infected before they reached the buyer, through the supply chain, and the owner never knew.
The XCPE botnet is the same pattern at a smaller scale. Google took it down on November 2 2026, after it infected about 1.3 million TV boxes from Videostrong Technology. TrendAI counted 1,472,554 infected devices across 206 models, and the proxy access was sold at $13.64 per 5 GB. The devices were not Play Protect certified, which is the first tell: a device that cannot run Play Protect is a device that was never meant to be in a consumer's hands.
Related reading on this site: Home and Device Fingerprinting: What It Catches and What It Misses cover the neighbouring problems in more depth.
The device farm is real hardware doing fake work
A device farm is different. It is a rack of real phones, dozens or hundreds of them, operated by a human or a script, each one a legitimate device with a real IMEI, a real SIM, and a real app installation. The farm's job is to look like a legitimate user at scale: create accounts, click ads, install apps, leave reviews. The hardware is real, so the device fingerprint is real, and the fraud tool that checks the fingerprint finds nothing wrong.
The tells are in the economics and the timing. A farm's devices share a purchase history, a SIM batch, and a network path. They activate in bursts, they perform the same actions in the same order, and they go quiet at the same time. The uniformity is the tell: a hundred real users do not all install the same app within the same hour and leave a five-star review within the same minute. A farm does.
SocksEscort and the router botnet
SocksEscort is the third pattern, and it sits between the two. Europol dismantled it in March 2026, after it compromised more than 369,000 routers and IoT devices and sold them as residential proxies. The devices were real, they were in real homes, and their owners did not know they were part of a botnet. The proxy service sold access to their IP addresses, so the traffic looked residential, because it was residential. It was also compromised.
The defense against all three is the same in principle and different in practice. For a bot farm, check the device certification, the IP reputation, and the behavior at scale. For a device farm, check the economics, the timing, and the uniformity. For a router botnet, check the IP against the threat intelligence feeds, because the residential IP is the one thing the attacker cannot fake. A fraud tool that checks only the device fingerprint will catch the bot farm and miss the device farm. A tool that checks only the IP will catch the router botnet and miss the farm. The three need three different checks, and the store that runs only one is blind to the other two.
Frequently asked questions
What is the difference between a bot farm and a device farm?
A bot farm is a network of compromised devices controlled remotely, usually without the owner's knowledge. A device farm is a rack of real phones, operated by a human or a script, that behaves like a legitimate user because the hardware is legitimate. The tells are different: a bot farm shows in the fingerprint and the IP, a device farm shows in the timing and the uniformity.
How big is BADBOX 2.0?
More than 10 million uncertified Android devices, mostly low-cost TV boxes and tablets, according to Google's Threat Intelligence Group in July 2025. The devices were infected before they reached the buyer, through the supply chain.
What was the 911 S5 proxy service?
A proxy service dismantled by the DOJ in May 2024 that controlled more than 19 million IP addresses. It sold access to compromised devices as residential proxies, so the traffic looked like it came from real homes.
How do I spot a device farm?
Look at the economics and the timing. A farm's devices share a purchase history, a SIM batch, and a network path. They activate in bursts, perform the same actions in the same order, and go quiet at the same time. A hundred real users do not all install the same app within the same hour.