What is a botnet, and how do you spot its traffic?

A botnet is a network of computers, routers, cameras and other devices that malware has taken over and that one operator controls remotely. The controlling servers are called command and control, or C2. Botnets send spam, flood sites with traffic, try stolen passwords and rent their members out as proxies. The owners of the infected devices rarely notice: the FBI said Qakbot victims were typically unaware their computers were infected.

#How does a botnet work?

1. Malware gets onto a device, for example through an email attachment or a router that still uses its default password.
2. The device reports to the operator's command and control servers and waits for instructions.
3. The operator sends one order to many devices at once: send spam, flood a target, scan for victims or relay traffic.
4. Infected devices scan for new victims, so the botnet can grow on its own.

Mirai, the best-known botnet of routers and cameras, showed how little it takes. It tried 10 username and password pairs per device, drawn from a list of 62 default logins, and grew to about 600,000 infected devices in 2016 (Antonakakis et al., USENIX Security 2017). For one real command server, field by field, see the anatomy of a C2 IP.

#How big do botnets get?

The numbers measure different things, from computers to IP addresses, so they show scale rather than a ranking. The 2024 advisory comes from the FBI, the Cyber National Mission Force and the NSA. It describes routers, firewalls, storage boxes and other IoT devices used "as a proxy to conceal their identities" and to launch denial of service attacks.

#How common is botnet traffic in abuse data?

Very common. In FFraud's open data (build of October 23, 2026, 07:30 UTC), more than half of the 1,580,496 confirmed abusive addresses have a botnet-related worst category. The category is the worst behavior recorded for each address, so the counts describe the file and its labels, with no claim about how many command servers exist on the internet.

Together these three categories hold 820,315 addresses, or 51.9 percent of the file. The list is free to download as the malicious IP database.

Botnet members are not only home devices. A random sample of 200 addresses whose worst category is botnet, looked up on October 23, 2026, found 141 in data centers and 58 on home connections. Of the 200, 180 had abuse confirmed within the past 30 days (FFraud API).

#How do you spot botnet traffic in your logs?

• Many addresses, one pattern. The same request, login attempt or scan arrives from hundreds of unrelated addresses.
• Logins with default passwords. Tries of admin and other factory logins on SSH, Telnet or router panels, the way Mirai spread.
• Addresses with a record. Sources that already carry botnet, scanning or brute-force history in an IP reputation lookup.
• Hosting and home networks alike. Hijacked servers sit in data centers, while infected routers and cameras sit on home and small-office lines, so check both.

#How do you protect a site and your own devices?

• Block confirmed bot addresses at the edge, and refresh the list often, because botnet members change.
• Rate limit and challenge bursts from many addresses, since no single address may cross a limit.
• Replace default passwords on routers, cameras and storage boxes, as the 2024 advisory urges.
• Patch firmware, disable unused services and reboot devices, and retire equipment that no longer gets updates.

#Questions people ask

To see whether an address is on record for botnet activity, check it with the free IP blacklist check.