A botnet is a network of internet-connected devices that have been infected with malicious software and placed under the remote control of one operator. Each infected machine, called a bot or zombie, keeps working normally for its owner while taking orders from a command-and-control (C2) server. The operator uses or rents out their combined bandwidth and, above all, their residential IP addresses. For advertisers the consequence is direct. Botnets manufacture ad requests, impressions and clicks that appear to come from real households, and the money paid for them goes to criminals.

How a botnet works

The lifecycle has three stages. The first is recruitment. Devices are infected through malicious email attachments, trojanised apps, unpatched router firmware, exposed debugging ports or, increasingly, before they leave the factory. The FBI's public service announcement of June 5, 2025 on BADBOX 2.0 described cheap streaming boxes, projectors, car infotainment units and digital picture frames that shipped with malware preinstalled or downloaded backdoored apps during setup. The FBI defines a botnet as devices "compromised by malware that can be controlled remotely without the owners' knowledge."

The second stage is check-in. The malware contacts its C2 infrastructure, reports the device's address and waits. Early botnets used Internet Relay Chat (IRC) channels for this, a centralised design that a 2007 USENIX paper by researchers at Johns Hopkins, UNC Charlotte and Georgia Tech said offered "a central point of failure". Later families shifted to peer-to-peer protocols and algorithmically generated domains, which make seizures harder.

The third stage is monetisation, and one infected device can serve several purposes at once:

  • Ad fraud. A hidden browser or modified ad software development kit (SDK) loads pages and video players, requests ads and sometimes simulates clicks. Because the request leaves from a real consumer address with a real device fingerprint, it passes the data-centre checks that catch cruder bots.
  • Residential proxying. The device relays strangers' traffic, so a scraper or fraudster appears to browse from a home connection. Access to BADBOX 2.0 devices was sold at $13.64 per five gigabytes.
  • Distributed denial of service (DDoS). Thousands of devices flood one target until it fails.
  • Spam, credential stuffing and malware loading.

In the programmatic chain, an infected phone or TV box may run a counterfeit or spoofed app that sends OpenRTB bid requests through supply-side platforms (SSPs). The demand-side platform (DSP) on the other end sees a plausible device type, app bundle and IP address. The Media Rating Council (MRC) classifies such activity as sophisticated invalid traffic (SIVT), the tier that requires multi-signal analytics and human review rather than list matching. Its guidelines, finalised on October 27, 2015 and rewritten as IVT 2.0 on June 25, 2020, name automated browsing from hijacked consumer devices as an SIVT type, as set out in PPC Land's invalid traffic explainer. PPC Land's click fraud explainer lists botnet distribution across thousands of devices among the core bot-driven tactics on search.

Origin and evolution

The term began innocently. Eggdrop, an IRC bot created around December 1993 to keep order in chat channels, can link with other Eggdrop bots "to form a botnet", according to its developers. The 2007 USENIX paper dates the first widely known malicious bots, the GTbot variants built on the mIRC client, to April 1998. SDbot (April 2002), Agobot (October 2002) and Spybot (April 2003) followed. Peer-to-peer designs such as Peacomm, observed in January 2007, removed the single server that police could seize.

Advertising became a botnet business early in the following decade. In March 2013 the analytics firm spider.io described Chameleon, which it said ran on more than 120,000 Windows machines in the US, imitated human visitors on at least 202 websites and drained more than $6 million a month from display advertisers paying an average CPM of $0.69. On December 5, 2013, Microsoft, the FBI and Europol disrupted ZeroAccess, a network of more than 2 million computers that hijacked search results on Google, Bing and Yahoo and cost advertisers an estimated $2.7 million a month, according to Microsoft.

Internet-of-things (IoT) devices changed the scale. Mirai, which hijacked cameras and routers through default passwords, reached a peak of 600,000 infections in late 2016, according to a 2017 USENIX Security study, and launched record DDoS attacks. Three men pleaded guilty in December 2017. Two also admitted infecting more than 100,000 devices between December 2016 and February 2017 for a botnet used mainly for advertising and click fraud, according to the Justice Department announcement as reported by TechTarget.

Adform disclosed HyphBot in November 2017, saying infected devices behind more than 500,000 IP addresses generated up to 1.5 billion requests a day across more than 34,000 domains. A year later, on November 27, 2018, prosecutors in the Eastern District of New York unsealed a 13-count indictment against eight people over Methbot and 3ve. Methbot ran on more than 1,900 rented servers, with over 650,000 IP addresses registered to look residential, and caused more than $7 million in losses. 3ve infected more than 1.7 million computers with the Kovter malware and caused more than $29 million in losses, according to the Justice Department. White Ops, now HUMAN Security, led much of the detection work.

Connected television (CTV) followed. HUMAN said PARETO, disclosed on April 21, 2021, used nearly one million infected Android phones to impersonate CTV devices, spoofing more than 6,000 CTV apps and averaging 650 million ad requests a day. Then came BADBOX, identified in 2023 and disrupted in 2024, and its successor BADBOX 2.0, which Google called "the largest known botnet of internet-connected TVs" when it announced a lawsuit on July 17, 2025. More than 10 million uncertified Android devices were compromised, and the ad fraud component peaked at 5 billion fake ad requests a week.

Why it matters for marketers

Botnets break the assumption that a residential address and a consumer device mean a person. CTV is the clearest case. Cost per thousand impressions is high, much inventory runs without JavaScript, and server-side ad insertion strips signals. DoubleVerify reported that CTV fraud schemes rose 140% between the first quarters of 2025 and 2026, and that bot fraud accounted for 82% of North American CTV violations. Both figures are self-reported. The same vendor's ShadowBot finding covered more than 35 million spoofed mobile devices in one quarter.

Search advertisers face a narrower version. Faktica, a click-fraud consultancy, described "coordinated botnets of IPs cycling through the same set of user-agents" in client accounts and showed how Google Ads IP exclusions can be bypassed when one address harvests click identifiers for another.

The devices also sit inside the inventory itself. Samsung restricted residential proxy SDKs on August 3, 2026 after Spur research found them in more than a quarter of Tizen apps and over 42% of LG webOS apps, so the TVs that display ads can double as relay nodes.

Limitations and disputes

Measurement is the first problem. Most botnet figures, from requests per day to device counts, come from companies that sell detection, and takedown announcements double as marketing. Adalytics argued in March 2025 that leading verification vendors still served ads to declared bots in data centres, a far easier case than a botnet; DoubleVerify called the report "misleading and manufactured". A securities class action filed on May 22, 2025 repeats the claim that its tools could not filter such traffic. Those are allegations, not findings.

Labels are the second. Methbot ran on rented servers, not hijacked homes; HUMAN's NewsJunkie case, disrupted in July 2026, combined server-side spoofing with residential routing without ever being called a botnet.

Consent is the third. Proxy SDKs that ask permission occupy a grey zone between infection and a bandwidth-sharing business, and residential proxies are not illegal in themselves. Google's threat intelligence group nevertheless called the market a "gray market" that "thrives on deception".

Durability is the last. BADBOX 2.0 grew out of a botnet already disrupted, and Google's court victory was against 25 unnamed defendants. Takedowns degrade infrastructure; they rarely remove operators.

Not the same as

  • Bot traffic is any automated traffic, including search crawlers and monitoring tools. A botnet is one source of it: compromised devices under criminal control.
  • Crawlers and verified bots announce themselves and can be confirmed through DNS, published IP ranges or signatures, as covered in PPC Land's verified bot explainer. Botnet traffic is designed to look human.
  • Residential proxies are a service that routes traffic through home addresses. Some pools come from consenting app users, some from botnets, as the residential proxy explainer details.
  • Click farms use paid humans on real devices rather than malware.

Recent developments

On January 28, 2026, Google's Threat Intelligence Group said it had used legal action and help from Cloudflare to degrade IPIDEA, which it called one of the world's largest residential proxy networks. Google tied 13 proxy and VPN brands and four SDKs to the operation, saw more than 550 threat groups using its exit nodes in one week, and linked its SDKs to BADBOX 2.0 and to the newer Aisuru and Kimwolf botnets. Synthient estimated that Kimwolf had infected just over 2 million Android TV boxes. Cloudflare attributed a 29.7 Tbps attack in late 2025 and a 31.4 Tbps attack on December 19, 2025 to Aisuru, and its 2026 threat report named Aisuru among the botnets driving record DDoS traffic. Cloudflare Radar tracks such attacks by autonomous system.

Samsung's SDK ban, the NewsJunkie disruption and the IPIDEA action share a target: the residential address layer that makes botnet traffic hard to separate from people.

Timeline

  • December 1993: Eggdrop IRC bot created; it links with other bots to form a "botnet".
  • April 1998: GTbot variants, among the first widely known malicious bots, appear.
  • January 2007: Peacomm, a peer-to-peer bot, observed by researchers.
  • March 2013: spider.io describes Chameleon, a display ad fraud botnet of over 120,000 machines.
  • December 5, 2013: Microsoft, the FBI and Europol disrupt ZeroAccess.
  • October 27, 2015: MRC invalid traffic guidelines finalised, creating the SIVT category.
  • Late 2016: Mirai peaks at 600,000 infections.
  • December 2016: White Ops discloses Methbot.
  • November 2017: Adform discloses HyphBot.
  • December 2017: Mirai creators plead guilty.
  • November 27, 2018: Methbot and 3ve indictment unsealed in Brooklyn.
  • June 25, 2020: MRC IVT 2.0 finalised.
  • April 21, 2021: HUMAN discloses PARETO.
  • May 27-29, 2024: Europol's Operation Endgame takes down more than 100 botnet-related servers.
  • June 5, 2025: FBI warns about BADBOX 2.0.
  • July 17, 2025: Google announces its BADBOX 2.0 lawsuit.
  • December 19, 2025: Cloudflare mitigates a 31.4 Tbps attack attributed to Aisuru.
  • January 28, 2026: Google announces the IPIDEA disruption.
  • July 7, 2026: HUMAN announces the NewsJunkie disruption.
  • August 3, 2026: Samsung restricts residential proxy SDKs on Tizen.

Summary

Who: Criminal operators who infect and control devices; security firms such as HUMAN Security, DoubleVerify, Spur and Synthient that detect them; platforms such as Google, Microsoft, Cloudflare and Samsung; and law enforcement bodies including the FBI and Europol.

What: A network of malware-infected computers, phones, TVs, routers and IoT devices controlled remotely through command-and-control infrastructure and used for ad fraud, residential proxying, DDoS and spam.

When: The term dates from the IRC bots of 1993; malicious botnets appeared in 1998, ad fraud botnets by 2013, and IoT and CTV botnets from 2016 onward, with major disruptions in 2018, 2025 and January 2026.

Where: On consumer devices worldwide, with BADBOX 2.0 infections reported in 222 countries and territories, and in the programmatic supply chain wherever bid requests from those devices reach SSPs and DSPs.

Why: Hijacked devices supply real residential addresses and device fingerprints that let fake traffic pass as human. That makes botnets the main engine of sophisticated invalid traffic, and the hardest to measure.