What is a botnet, and what does it do to your site?

A botnet is infrastructure, not an attack: the same network can be pointed at different targets and jobs.

1. Devices are infected. Through default passwords, unpatched software or malicious downloads.
2. They report to a controller. A command-and-control server, or each other in a peer-to-peer design.
3. The operator sends instructions. Which target, which technique, for how long.
4. The bots act together. Each sends a share of the traffic, so the total is large and every single source looks small.

Access to a botnet is often rented. That is why attacks that once needed a large organisation can now be started by anyone willing to pay.

• DDoS attacks. Floods at every layer; see what is a DDoS attack and DDoS attack types.
• Credential stuffing and brute force. Sign-in attempts spread across thousands of addresses; see credential stuffing.
• Scraping. Copying content or prices from addresses that look like ordinary visitors; see data scraping bots.
• Spam and fraud. Form submissions, fake sign-ups and fake clicks; see spam bots.

The person who controls a botnet is often called a bot herder. Some build their own networks by spreading malware; others buy or rent access from someone who did. A rented botnet comes with a simple interface: pick a target, a method and a duration.

This changes who attacks. A flood or a credential stuffing run no longer needs technical skill, only payment, so small sites are targets too. It also means the same devices turn up in unrelated attacks, against different victims, within days.

A single bot is hard to spot; the botnet shows in patterns across many requests. Look for the same behaviour repeated from many addresses at once: identical request sequences, the same unusual header set, the same timing, or a sudden spread of sources hitting one endpoint.

Address reputation helps a little, because some infected devices appear on lists, and hurts a little, because the addresses belong to real people who may also be your customers. The useful signals are behavioural and aggregate, which is the subject of bot detection.

Because the sources are many and real, defences that count per address miss most of it. What works is limiting by what the request does, such as attempts per account or cost per endpoint, absorbing floods with capacity in front of the site, and making the targeted action expensive to repeat. DDoS protection covers the flood side; rate limiting covers per-endpoint limits.

Keeping your own devices out of botnets is part of the same problem: change default passwords, patch exposed devices, and do not leave management interfaces open to the internet.