What Is a Botnet? How Everyday Devices Become DDoS Weapons

Almost every large DDoS attack is powered by a botnet — a hidden army of hijacked devices doing an attacker's bidding. Understanding how botnets are built and controlled is the first step to understanding the threat your server faces. Here is the full picture.

What is a botnet?

A botnet is a network of internet-connected devices that have been secretly infected with malware and can be controlled remotely, all at once, by a single operator (the "botmaster"). Each infected device is called a bot or zombie — it keeps working normally for its owner while quietly waiting for commands in the background.

On its own, one infected device is harmless. The danger is scale: link tens or hundreds of thousands of them together and you have a distributed weapon capable of overwhelming almost any target. That is exactly what powers a DDoS attack.

What devices end up in a botnet?

Early botnets were built from infected Windows PCs. Today the bulk of the firepower comes from the Internet of Things (IoT) — the billions of cheap, always-on, rarely-updated gadgets connected to home and business networks:

• Home routers — often running outdated firmware and default passwords.
• IP cameras & DVRs — internet-exposed and almost never patched.
• Smart-home gear — plugs, bulbs, doorbells, NAS boxes.
• Servers & VPSes — misconfigured or compromised machines with big bandwidth.

These devices are perfect recruits: powered on 24/7, sitting on fast connections, and their owners rarely notice anything is wrong.

How a device gets infected

Most IoT botnets spread automatically. The malware constantly scans the internet for devices with open management ports, then tries a list of default and common passwords (admin/admin and friends). When one works, it installs itself, reports back to the botmaster, and immediately starts scanning for the next victim — a self-replicating worm. This is how the infamous Mirai botnet grew to hundreds of thousands of devices in days.

How a botnet is controlled

Bots talk to command-and-control (C2) infrastructure run by the operator. The botmaster issues a single instruction — "attack this IP, on this port, with this method" — and every bot obeys at once. Modern botnets use resilient C2 (multiple servers, encrypted channels, peer-to-peer fallbacks) so taking one server offline does not kill the whole network.

A botnet turns the carelessness of millions of strangers into a weapon that can be aimed at your server in seconds.

Why botnets matter to game servers

Botnets are what make modern attacks both huge and cheap. Their capacity is rented out by the hour through booter and stresser services, so a single annoyed player can point hundreds of gigabits at your server for the price of a coffee. The traffic comes from thousands of real, scattered IPs — which is exactly why you cannot simply "block the attacker".

Can you protect your own devices?

Yes, and you should — it keeps you out of someone else's botnet:

• Change default passwords on every router, camera and IoT device.
• Keep firmware updated; replace gear the vendor no longer patches.
• Do not expose device management ports to the internet.
• Put IoT on its own network, away from important machines.

But hardening your own gadgets does nothing to stop a botnet pointed at your server. For that, the traffic has to be absorbed and filtered upstream.

How to defend a server against botnet attacks

You cannot out-muscle a botnet from a single machine. The only durable defence is to host behind a network with enough capacity to soak up the flood and filter it before it reaches you — ideally with game-aware mitigation like XDP close to the server. That is the model behind our Anti-DDoS: a multi-Tbps Frankfurt network plus in-house filtering, on by default.