How to Spot Bot and Troll Accounts on Instagram and X

Not sure if an account is real? Most bot accounts give themselves away within a minute if you know where to look. Below are the signs on Instagram and X, how to recognise the newer AI-written bot comments, and what to do when you find a bot or a troll.

Quick answer: 7 signs an Instagram account is a bot

1. No real profile photo. It is missing, a stock image, or a photo you can find on other profiles (a reverse image search shows this quickly).
2. A username that looks generated. A first name followed by a long string of numbers or random letters, or a handle that does not match the display name.
3. Lopsided numbers. It follows thousands of accounts but has few followers, or has thousands of followers and almost no posts.
4. Few or no posts. No posts at all, or a handful of generic images uploaded within the same few minutes.
5. Generic comments. "Nice pic 🔥", "Love this! 😍" or "DM us to collab": comments that would fit under any post.
6. Message requests with an offer or a link. Promises of followers, a "brand ambassador" deal, crypto or a prize, usually with a link.
7. A very new account. Where Instagram shows it, the "About this account" page lists the date the account joined. A profile created last week that already comments on hundreds of posts is a strong signal.

One sign alone proves little: plenty of real people use a cartoon avatar or never post. Three or more together usually mean automation.

How to spot bots on X

The profile signs above apply on X too. Researchers add three behaviour patterns:

• Anonymity. The less personal information an account gives, the more likely it is automated: stolen photos, alphanumeric handles, names that do not match the handle.
• Activity. Divide the number of posts by the number of days the account has existed. The Oxford Internet Institute's Computational Propaganda team treats more than 50 posts a day as suspicious, and many bots post far more.
• Amplification. Bots mostly boost others: reposts, likes and quote posts, or links shared from the same few sites without any comment. Many accounts reposting the same post once each, at the same time, is the sign of a botnet.

New: AI-written bot comments

Bots used to copy and paste the same line everywhere. Many now use AI to write a fresh comment for every post, so "it wrote its own comment" no longer proves that a person is behind an account. Watch for:

• comments that restate the post in polished, generic words ("What a great reminder that consistency is key!") without adding anything;
• the same account leaving comments like this on dozens of unrelated posts within minutes;
• no real answer to a follow-up question, or another generic line;
• a closing nudge elsewhere: "check my profile", "DM me".

Bots vs trolls: what is the difference?

Some accounts are both: one person running many semi-automated profiles.

How to spot a troll

A troll is a real person who posts to provoke rather than to discuss. Common signs:

• Going off-topic to derail a thread.
• An aggressive or dismissive tone, often with personal attacks.
• Ignoring facts that contradict their point.
• Not letting it drop: posting again and again until they get a reaction.
• Fake or brand-new profiles used for a single argument.

If someone is not interested in a good-faith discussion and is provocative on purpose, treat them as a troll.

What to do when you find a bot or a troll

• Do not engage. A reply gives a troll the reaction they want and tells a bot the account is active.
• Report it. Use Report on the profile, the comment or the message. Reports help platforms remove fake accounts, and Instagram asks accounts that behave suspiciously (for example, liking or following very fast) to confirm they are a real person with a short video selfie.
• Block or restrict. On Instagram, Restrict makes that account's comments on your posts visible only to them, and they are not told.
• Filter comments and message requests. Instagram's Hidden Words hides offensive comments and message requests, and you can add your own words, such as "promote your page" or "collab". Hidden requests go to a separate folder.
• Turn on Limits during a spam wave. Limits temporarily hides comments and message requests from accounts that do not follow you or followed you only recently.
• Never click links in unexpected messages, and never send a code or a photo of yourself to someone who asks you to "verify" your account. Real checks happen inside the app.

If you run a business on Instagram

For a business account, bots are more than an annoyance. Spam comments and fake message requests land in the same inbox as real customers asking about prices and free slots. Filters cut the noise, but someone still has to answer the real messages quickly: a customer who waits hours usually books somewhere else.

Monitoring bots and trolls as a brand

Brands that track what people say about them face the same problem at scale. For X, collect data through X's official APIs: that is the compliant way to read public conversations at scale, with documented rate limits and terms you can operate under. Scraping and unofficial workarounds are not a sustainable basis for brand monitoring.

On top of that data, teams typically combine:

• Platform signals (account status and enforcement, API metadata where available)
• Their own heuristics (the activity and amplification patterns above)
• Human review for high-stakes brand or crisis cases

That way analysts spend their time on real conversations instead of spam. If you want to discuss social intelligence workflows, book a demo.