Facebook deleted more than 1,000 fake accounts in March, including a few hundred linked to a troll farm in Albania. The company shared the withdrawals as part of its coordinated inauthentic behavior on the platform.

In its report, Facebook named 14 different networks of fake accounts that were deleted during the month of March. The fake accounts come from a number of countries including Iran, Spain, Mexico, Argentina, Egypt, Israel, Benin, Georgia, Comoros and El Salvador.

The company notes that most of them weren’t particularly successful, and many accounts were deleted before they could attract large audiences. “This is an ongoing pattern that we have seen where we see threatening actors continue to try to use these techniques to manipulate public debates on our platforms, and more broadly on our internet platform.” Facebook chief security officer Nathaniel Gleicher said on call with reporters. “But thanks to the defensive efforts of the teams, not just at Facebook, but also in industry, in civil society and in government, we see them getting less and less traction.”

Facebook also detailed its investigation into a troll farm in Albania, which managed 128 Facebook accounts and 146 Instagram pages. The company said it had linked the troll farm to an exiled Iranian militant group that is now based in Albania. The fake accounts “primarily targeted Iran and also a global audience with Iran-related content” and “made special efforts” to lure its followers to websites related to militant groups.

The accounts had gained approximately 9,000 followers on Facebook and 112,000 on Instagram. Facebook says accounts were “the most active” in 2017, but saw an increase in activity in the second half of last year. The company notes that its investigation revealed several “features” of a troll farm which indicated that all activity originated from one location. Ben Nimmo, Facebook’s Global IO Threat Intelligence Lead, said the accounts were all posted regularly on the same schedule, peaking in the morning and evening, with what appeared to be a midday lunch break. “When you combine the daily posting model with the way the accounts are technically connected, it really looks like a team of trolls who are dynamic offices,” Nimmo said.