Quick answer
A botnet is a collection of internet-connected devices that have been compromised and can be commanded remotely by whoever controls them. The owners of those devices are usually unaware — the machine keeps working normally while quietly taking orders. Botnets are rented out and used for distributed denial-of-service attacks, credential stuffing, scraping, click fraud and spam. Their defining property for a defender is distribution: instructions come from one place, but traffic arrives from thousands of unrelated addresses at once.
How a botnet is assembled
Most botnets are not built by breaking into anything sophisticated. They are assembled by scanning the internet for devices with known vulnerabilities or default credentials and installing a small program that phones home for instructions.
Consumer routers, IP cameras, DVRs and other embedded devices are the classic recruits: permanently online, rarely updated, often shipped with a default password, and almost never monitored by their owners. A compromised camera can spend years in a botnet without anyone noticing.
- Scanning for default or reused credentials on exposed management ports
- Exploiting unpatched vulnerabilities in embedded firmware
- Malicious downloads and email attachments on desktop machines
- Compromised or abandoned cloud instances, which have far better bandwidth
How they are controlled
Every bot needs to receive instructions, and the mechanism it uses is the botnet's biggest weakness. Older designs had every bot connect to a single command-and-control server, which meant seizing that one server ended the whole network.
Modern botnets are more resilient. They use algorithmically generated domain names so there is no fixed address to seize, peer-to-peer designs with no central server at all, or ordinary services — chat platforms, code hosting, social media — as a hiding place for commands.
| Design | How it works | How it is taken down |
|---|---|---|
| Central C2 | All bots connect to one server | Seize the server; whole network dies |
| Domain generation | Bots compute new domains daily | Register the domains before the operator does |
| Peer-to-peer | Bots relay commands to each other | Very hard — no single point to remove |
| Third-party services | Commands hidden in normal platforms | Requires the platform's cooperation |
What they are used for
DDoS is the most visible use but far from the only one. A botnet is really just a large pool of internet connections that someone else is paying for, which makes it useful for anything that benefits from looking like many different people.
- DDoS attacks — sold openly as "stresser" or "booter" services
- Credential stuffing, where each attempt appears to come from a different address
- Scraping at scale, spread thin enough to defeat per-address rate limits
- Click and impression fraud against advertising networks
- Spam relaying and phishing distribution
- Residential proxy networks, sometimes sold as a legitimate product
Why they are hard to defend against
A botnet's advantage is that every individual request looks ordinary. One connection from a home broadband address requesting your homepage is exactly what a customer looks like. Only the aggregate reveals the pattern.
This is why rate limiting per address does so little: each bot only needs to send a handful of requests. Ten thousand bots making two requests a second each will pass any sane per-client limit while delivering twenty thousand requests a second to your origin.
- Look for one signature repeated across many unrelated addresses
- Compare against your own baseline, not a fixed threshold
- Use challenges — a bot on an embedded device usually cannot run JavaScript
- Corroborate before acting, so one unusual visitor is never treated as an attack
Keeping your own devices out of one
- Change default credentials on anything with a management interface
- Do not expose router, camera or NAS admin ports to the internet
- Keep firmware updated, and retire devices the vendor no longer patches
- Watch for outbound connections from devices that should have no reason to make them
Frequently asked questions
Last updated