A botnet is a network of compromised devices controlled together by an operator. Attackers use botnets to distribute automated abuse across many addresses.

The devices can include ordinary computers or poorly secured connected equipment. Their owners may be unaware that software on the device is receiving instructions and sending traffic on someone else’s behalf. For an online service, the requests may arrive from many apparently unrelated locations.

How a botnet operates

An operator gains control of devices through compromise and establishes a way to send instructions. Some botnets use centralized command-and-control infrastructure; others distribute that communication across participating devices. The arrangement can change without changing the basic purpose of coordinating activity.

The operator can direct devices toward a target or divide work among them. Distributed denial-of-service attacks use this capacity to overwhelm a service. Other activity can involve sending spam or supporting attempts to compromise accounts.

Botnets in customer-account attacks

In a credential-stuffing scenario, automation tests stolen username and password combinations. Distributing those attempts across many sources can make a simple per-address rate limit less effective. Each source may generate relatively little traffic while the combined activity targets a large account population.

The same infrastructure can support repeated account registration or promotion abuse. Distribution explains where requests come from, but it does not establish whether a particular transaction is fraudulent. Detection still needs to connect technical activity with what the accounts are doing.

For example, a retailer might see many registrations with different network addresses but unusually similar behavior. The useful investigation is the relationship among those requests, not an assumption that any shared characteristic proves a botnet.

Botnet, bot attack or proxy network?

A bot attack describes automated abusive activity. It can run from a small number of rented servers without a botnet. A botnet describes a controlled collection of compromised devices, which can support several types of attack.

A proxy network routes traffic through intermediary addresses. Some are used legitimately, while others support abuse; the presence of a proxy does not by itself prove that its devices were compromised. Treating all three concepts as interchangeable can produce poor detection rules.

Defenses should combine network intelligence with account-level activity and behavioral evidence. Rate limits can operate across several dimensions, including an account or a sensitive action. Challenges should reflect the evidence of abuse so legitimate customers sharing a network are not blocked simply because they have the same public address.

Frequently asked questions

Does every bot attack use a botnet?

No. Attackers can run automation from their own infrastructure or rented services. A botnet is one possible source of that activity.

Can a home router be part of a botnet?

Yes. Connected devices can become participants if compromised and controlled by an operator. They do not need to resemble a conventional desktop computer.

Will blocking one IP address stop a botnet attack?

Usually that addresses only one source. Distributed activity requires controls that evaluate patterns across requests and accounts as well as individual network addresses.

Related: Bot Attack · Bot Detection · Credential Stuffing · Automated Attacks · IP Intelligence · Registration Bots