Since being acquired by Facebook last year, Instagram has undergone significant changes. In addition to being subtly folded into Facebook’s platform, the photo-sharing app has also made some rather surprising updates to its Terms of Service, and ended its relationship with Twitter. Instagram has transitioned from the little-indie-startup-that-could into a legitimate player in the social and mobile markets. And when a social platform gets big, you know what follows, don’t you? The bots.

The moment a social network reaches near-ubiquity is the moment that everyone starts trying to figure out how they can use it to make money. No place is sacred; Twitter, Facebook, Pinterest – there are more than enough marketing applications (both made in-house and by third-party developers) that turn these social networks into a cesspool of legitimate and illegitimate business promotions.

It only stands to reason that Instagram would fall subject to the same treatment. Despite any outrage and fall out over its Terms of Service debacle, Instagram has remained insanely popular, and its user base is growing: The app has more than 90 million monthly active users and 16.4 million daily active users. And much like Twitter, it’s reining in its content so Instagram photos are viewed in the place and format it desires. Naturally, marketers want to reach those millions and millions of eyeballs opening up the app. Unfortunately for us, the preferred way for shady businesses to reach people just so happens to be spambots: automated accounts that exist only to promote whatever their masters point them to.

The evidence is mounting. We’ve all seen it in our feeds; phrases like #getmorefollowers, #getmorefollowershere, and #getmorelikes are some of the most popular hashtags in the app. Many of them lead back to users like the one below, and this one, which share zero photos but spam feeds and comment sections advertising their business.

But Instagram is different than Twitter or Facebook. It’s all visual and interaction is mostly happening on mobile (as there’s no real ability to browse the feed via desktop), so spambots will have to function differently. I decided to get my hands dirty in an SEO forum to find out exactly how these services operate – and to use them.

BlackHatWorld has no shortage of information on Instagram bots. Some of the most popular options can be found at Instagrambots.net, a site that sells products like InstaDominate, InstaGet, InstaMarket, Bostagram, and ZeusGram (and these are just what Instagrambots.net is selling; there are so many more options). The site also offers you the choice of paying anywhere between $10 and $100 for likes, accounts, comments, or followers.

And for $10, I had to try. After snagging the “$10 for 200 comments” option, I entered my information, and hit purchase. I got a receipt via PayPal that said I’d sent $10 to “Social Media,” but nothing else.

After I fired off a few displeased emails asking where my 200 comments were, I tried the chat support on the site. I then was told I needed to send links for the pictures I wanted comments on. I chose a handful of random images from my account but got weary of this after about 10 photos. For a bot service, there was a considerable amount of manual work involved. I was promised delivery within 48 hours, so stay tuned.

Then there some more human ways of using Instagram for these purposes. Instamacro auto-likes Instagram photos for you; you can enter tags for it to filter these likes by or just let script randomly select images. “[Instamacro] is getting the latest tagged pictures from the most popular tags, and liking them,” Instamacro tells me. “This way, users pay attention to your account and either follow you or like your pictures back. All the followers and likes are real, so nothing is fake.” Except, of course, that I didn’t look at any of the images involved in my liking-spree.

But it works. It really, really works. After running Instamacro for 30 minutes, I opened up Instagram to see I had 79 new likes and six new followers. Five minutes after that, another 19 likes. Whatever this says about my popularity, I’ve never seen numbers like that. Of course, a great many of them came from accounts that had bot written all over it. To be fair, many of the accounts were real people and brands as well – which is perhaps the craziest part to me: That reciprocity is that effective on Instagram. Simply by fake-liking these users’ photos, they liked mine back, and many started following me. Some of them liked more than 10 photos, only because I’d, assumingly, done so for them.

Another bot-free solution called Boostagram has a similar concept. The service, launching soon, says it can get you real interaction. “We will never use bots in our service,” a recent Instagram post from the startup says. “All of the followers you get will be real and active people who follow you because they want to.” Instautomator is yet another service following this human-botting scheme by automating your account to like and follow other users – who in turn, pay attention to your account, and hopefully follow and like your images back.

So what’s the harm? Well, for starters, it’s all against the Instagram API’s terms of use. “You shall not use the Instagram API to post automated content to Instagram, including likes and comments that were not initiated and entered by an Instagram users.” Also, this: “You shall not use Instagram’s API to spam, or otherwise harass users with unwanted likes, comments, or other actions.” While it’s hard to imagine someone doesn’t want their images liked, there’s no telling how many users I spammed with my like-jacking today. I just know it was a lot – somewhere in the range of 3,000 likes.

The other risk, of course, is it puts the Instagram experience at risk. While it grew fast and furiously into the social media limelight, Instagran managed to build an app that users fell in love with. In a market filled with failed social apps that get all the hype and issue all the overpromises in the world, Instagram hit a nerve with users and actually connected people in the real world – something that’s proved to be social networking’s white whale. The threat of spambots is a very real concern, and one that will undoubtedly hurt Instagram’s appeal. Because seeing those orange alerts appear when I open up Instagram just isn’t quite the same when I know how they got there.