What is Botnet?

Botnets are built one infection at a time, usually through phishing attachments, drive-by exploit kits, or credential stuffing against internet-exposed services, but the fastest-growing source over the past decade has been consumer and industrial IoT devices shipped with default or hardcoded credentials. The Mirai botnet demonstrated this at scale in 2016, scanning the internet for devices still using factory-default Telnet logins and assembling hundreds of thousands of cameras and routers into a network capable of generating over a terabit per second of DDoS traffic. Once infected, a device checks in with command-and-control infrastructure to receive instructions, and botmasters use two broad architectures for that channel. Centralized C2 relies on a fixed set of servers, historically IRC channels, now more often HTTP or HTTPS endpoints mimicking normal web traffic, which is simpler to run but gives defenders a single point to take down. Decentralized or peer-to-peer botnets have bots relay commands to each other, so no single server's seizure kills the network, at the cost of more complex coordination logic.

A major evasion technique is the domain generation algorithm, where infected hosts compute a large list of pseudo-random domain names each day and try to resolve them until one matches a domain the botmaster has actually registered, so blocking a handful of known C2 domains does nothing since tomorrow's list is different. Fast-flux DNS compounds this by rotating the IP addresses behind a single C2 domain rapidly across many compromised hosts, making the infrastructure itself a moving target for takedown efforts.

Monetization drives what a botnet actually does once assembled. DDoS-for-hire is the most visible use, renting out bot capacity to flood a target with traffic. Spam and phishing campaigns route through bots to evade sender-reputation blocklists that would flag a single source firing millions of emails. Credential stuffing bots replay leaked username-password pairs against login pages at high volume, distributed across thousands of source IPs to defeat simple rate limiting. Cryptomining botnets hijack CPU and GPU cycles quietly in the background, and some botnets exist purely as a distribution channel, delivering ransomware or additional payloads to already-compromised machines for a fee.