Somebody Is Botting a Dead Card Game (and the Data Shows Exactly How)

As a chronic Steam user, SteamDB is one of my regular haunts (shout out xPaw). On Wednesday I randomly visited the site and noticed a strange spike in player count for one of my guilty pleasures, Artifact. The game (a card game set in the Dota universe) released in 2018 to mostly negative reviews and was virtually DOA. So why did a game that's been deceased for 5+ years suddenly gain 10,000 concurrent players in a matter of hours?

Any casual gamer will tell you: it's a bot farm. It's so unbelievably obvious that it got me thinking, surely Valve has a way to identify suspicious activity like this and put a stop to it. Heck, you could confidently ban 10,000+ accounts from this occurrence alone. While they do have public information on VACnet ("Valve's AI anti-cheat — revealed at GDC 2018 — that uses deep learning to detect cheating behavior in Counter-Strike 2"), I'm not aware of anything Steam-wide that's available to the public.

As an outsider, I can only analyze what's publicly visible through SteamDB. But even with a limited dataset, a few games are enough to establish what real player activity looks like, for both active and dead games. Using three Valve titles (Artifact, Dota 2, and Artifact Foundry), I'll show that this spike is automated activity, not human players. One thing I can't do from the outside is attempt attribution. Who's running this and why lives in Valve's telemetry, not mine. Everything below describes the activity, not any specific threat actor.

Evidence

1. Batch sizes that repeat across events

On July 10, the surge didn't ramp up like a crowd of nostalgic gamers arriving. Instead, it stepped through discrete levels and parked at each one: 276 → 1,043 → 1,297. Then on July 15, after a total wipeout (more on that in a second), the rebuild stepped through 277 → 1,048 → 1,301.

Same levels. Two separate events. Five days apart.

Real audiences don't come in fixed batches of ~255 and ~510, those numbers are somebody's config file, not a crowd. This is a tooling fingerprint: whatever spun up the July 10 bot fleet also rebuilt it on July 15.

2. Steam's Tuesday maintenance: an accidental experiment

Every Tuesday, Steam does routine maintenance that briefly knocks players offline platform-wide. That's actually a gift for this analysis: the same shock hits every game at the same moment, so you get to watch how a real population reacts versus this one.

Dota 2 dipped and kept 67% of its players online (real people just reconnect). Artifact kept 0.3%, collapsing to exactly 22 players… which happens to be its pre-spike human baseline. For a few minutes, the bots vanished and you could see the actual living population of Artifact: about two dozen geeks like me.

Then the "players" came back. They didn't reconnect like humans do but instead redeployed in the same batch ladder over 8 hours.

3. The zero-variance hold

For nearly an hour on July 10, the player count sat between 1,296 and 1,298. A range of two players at ~1,300 CCU (concurrent users). Real populations constantly churn. Somebody's pizza arrives, somebody's game crashed, somebody alt-tabbed into oblivion. Thirteen hundred humans physically cannot hold a number that still.

4. Humans don't arrive by cron

Big, synchronized jumps in player count landed at 06:00 UTC on July 11, 12, 14, and 15. Audiences show up when they get off work or see a social media post; schedulers show up at the exact same minute every day. And the original onset went from 25 players to 10,841 within a single 10-minute window.

5. The Foundry problem

Artifact Foundry — the reworked and frankly better version of the game — flatlined at 1–3 players the entire time. This single chart disproves every organic explanation: a viral video, streamer attention, nostalgia. If people were flocking back to Artifact because of social media, at least some of them would land on the better version of the game. A 400x surge that perfectly avoids the superior edition of the same game? Sus.

Additional insights

The classic tell is that bots are "flat." Real games breathe with timezones (busy evenings, dead 4 AMs), and bot farms don't sleep. You can measure this as a trough-to-peak ratio: Dota 2's quietest hour holds about 49% of its busiest hour. Artifact during the spike? 76%. While this is an elevation, it may not be the smoking gun you'd expect. Why? Because the botnet's own scheduled resizing manufactures a fake daily rhythm. The operator resizes the fleet on a schedule, and from a distance that looks like players coming and going.

Conclusion

Plausible motives for a fleet like this include but are not limited to playtime inflation, review weight farming, and chart manipulation (the Steam idler ecosystem is well-documented). But with the data at my disposal, I can't even begin to attempt attribution (i.e., the fun work). Future personal work includes continued manual monitoring of Artifact through SteamDB (I'd love to capture the teardown of this campaign) and eventually my own monitoring infrastructure across the Steam longtail (in accordance with Steam's ToS, of course).