What is a botnet?

02How large botnets get

Size is easiest to grasp through the cases that were measured or dismantled. The figures come from the researchers, providers and authorities listed in the sources.

Attack sizes keep climbing. Cloudflare's report for the fourth quarter of 2025 records a 31.4 Tbps attack that lasted just 35 seconds, and attributes that quarter's hyper-volumetric floods to the Aisuru-Kimwolf botnet, an estimated 1 to 4 million infected hosts, mainly Android TVs.

03How they are controlled

Every bot needs to receive instructions, and the mechanism it uses is the botnet's biggest weakness. Older designs had every bot connect to a single command-and-control server, which meant seizing that one server ended the whole network.

Modern botnets are more resilient. They use algorithmically generated domain names so there is no fixed address to seize, peer-to-peer designs with no central server at all, or ordinary services such as chat platforms, code hosting and social media as a hiding place for commands.

04What they are used for

DDoS is the most visible use but far from the only one. A botnet is really just a large pool of internet connections that someone else is paying for, which makes it useful for anything that benefits from looking like many different people.

• DDoS attacks, including HTTP floods that look like ordinary page views, sold openly as "stresser" or "booter" services
• Credential stuffing, where each attempt appears to come from a different address
• Scraping at scale, spread thin enough to defeat per-address rate limits
• Click and impression fraud against advertising networks
• Spam relaying and phishing distribution
• Residential proxy networks, sometimes sold as a legitimate product

05Why they are hard to defend against

A botnet's advantage is that every individual request looks ordinary. One connection from a home broadband address requesting your homepage is exactly what a customer looks like. Only the aggregate reveals the pattern.

This is why rate limiting per address does so little: each bot only needs to send a handful of requests. Ten thousand bots making two requests a second each will pass any sane per-client limit while delivering twenty thousand requests a second to your origin.

A quick look at distribution helps. Grouping requests by /24 network shows whether traffic is concentrated, as a single abusive host would be, or spread thinly across many networks, which is the botnet shape. Treat it as a first look rather than a verdict, because a popular site has a long tail too.

• Look for one signature repeated across many unrelated addresses
• Compare against your own baseline, not a fixed threshold
• Use challenges such as a proof-of-work challenge: a bot on an embedded device usually cannot run JavaScript
• Corroborate before acting, so one unusual visitor is never treated as an attack

awk '{split($1, o, "."); print o[1] "." o[2] "." o[3] ".0/24"}' access.log \
  | sort | uniq -c | sort -rn | head -20

06Botnets for hire, and the law

Most people who launch a botnet attack never built a botnet. They rent one through a booter or stresser site, often marketed as a load-testing service. Law enforcement treats that as what it is: in December 2024 Europol coordinated Operation PowerOFF across 15 countries, taking 27 such platforms offline, arresting administrators and identifying around 300 users, some of whom face prosecution.

Using these services against infrastructure you do not own is a criminal offence in most jurisdictions, whatever the marketing says; is DDoS illegal covers the legal position in more detail.

07Keeping your own devices out of one

• Change default credentials on anything with a management interface
• Do not expose router, camera or NAS admin ports to the internet
• Keep firmware updated, and retire devices the vendor no longer patches
• Be wary of free VPN and proxy apps that ask for broad network permissions
• Watch for outbound connections from devices that should have no reason to make them