Botnet
A network of compromised devices ("bots") controlled remotely by an attacker, used to launch DDoS attacks, send spam, mine cryptocurrency, or brute-force credentials at scale.
Last updated:
What is a botnet?
A botnet is a collection of internet-connected devices that have been infected with malware and are controlled as a single unit by a remote operator — the "botmaster." Each compromised device (a bot or zombie) runs quietly in the background while listening for instructions from a command and control server. Modern botnets span tens of thousands to millions of devices, including residential routers, IP cameras, DVRs, and unpatched servers.
What botnets are used for
Botnets are a rented commodity in the criminal economy. The same network can be repurposed for:
- DDoS attacks — the classic use; flood a target with traffic from thousands of source IPs
- Spam delivery — send millions of messages without the sender IPs tracing back to the botmaster
- Credential stuffing and brute force — distribute attempts across bots so no single IP trips rate limits
- Click fraud — simulate ad clicks to drain advertiser budgets
- Cryptomining — steal CPU cycles from infected devices
- Proxy-for-rent — sell bot IPs as "residential proxies" to customers who want to look like real users
How botnets are detected
Network-level detection looks for beaconing — periodic outbound connections to the same remote host with suspiciously regular timing. IP reputation databases flag IPs that have been seen participating in known botnet campaigns; traffic from those IPs is high-risk by default. At the internet scale, takedowns usually require sinkholing the C2 domain or seizing the operator's infrastructure. For defenders of individual services, checking source IPs in an IP abuse report checker quickly flags traffic from known-bot IPs.