What Is a Botnet?

A botnet is a network of internet-connected devices that have been compromised with malware and placed under the control of a single operator, often called a bot herder. The infected devices — PCs, routers, IoT hardware, and smartphones — keep working normally for their owners while quietly executing the operator's commands: sending spam, testing stolen credentials, overloading servers, or routing other people's traffic.

How Botnets Are Built

Devices are recruited through malware infections, unpatched vulnerabilities, weak default passwords, and trojanized apps. Once infected, a device connects to the operator's command-and-control infrastructure and waits for instructions. Modern botnets use resilient architectures, including peer-to-peer coordination and disposable command servers, which makes takedowns difficult and slow.

The scale can be striking. Law-enforcement takedowns have repeatedly dismantled botnets spanning millions of compromised devices across nearly every country, some of which had operated for years before being disrupted.

What Botnets Are Used For

Botnets are general-purpose attack infrastructure. Typical uses include distributed denial-of-service attacks, large-scale credential stuffing, spam and phishing distribution, click fraud, and cryptomining. One increasingly important use is proxying: infected devices are rented out as exit points in residential proxy networks, letting paying customers route their own traffic through unsuspecting households. Several of the largest residential proxy services dismantled by law enforcement were built directly on botnet infrastructure.

Why Botnets Defeat Simple Defenses

Because a botnet's requests originate from thousands of distinct, legitimate-looking devices and network connections, no meaningful IP pattern emerges to block. Each individual device sends only a small number of requests, staying under rate limits. Geographic distribution matches real user populations. Defending against botnet-driven abuse therefore requires evaluating each request on its own merits rather than relying on network-level reputation alone.

In practice that means checking the browser environment and device characteristics for automation artifacts that persist regardless of which network a request comes from, and maintaining intelligence on known proxy and botnet exit points — the approach CaptchaFox takes with its multi-signal analysis and a dedicated residential proxy IP database. Proof-of-work challenges add a further economic lever: a per-request compute cost that stays negligible for a single human but multiplies across a distributed campaign.