Quick Answer: A botnet is a network of hacked or infected devices (phones, smart TVs, streaming boxes, routers, computers, servers) that criminals control remotely. A "botnet hack" can mean two things: your device being compromised and enrolled in a botnet, or an attack carried out by a botnet, such as a flood of fake traffic. In advertising, botnets are used to generate fake ad views and clicks, hide ads on invisible pages, fake app installs, and relay traffic through victims' home internet connections. If you own a device, watch for odd behavior, unknown apps, high data use, and off-brand hardware with questionable firmware. If you buy ads, look for traffic that is cheap, high-volume, and engages with nothing. Protect yourself by updating devices, buying from reputable sellers, replacing devices with compromised firmware, using allowlists and independent verification for ad placements, and monitoring traffic quality.
This guide is for defense and response. It explains how botnets work at a conceptual level, and it does not include instructions for building or operating one.
What is a botnet?
A botnet (short for "robot network") is a group of internet-connected devices infected with malware and controlled by an attacker through a command-and-control system. The devices are called bots or zombies. The owners usually do not know their device is involved.
Botnets can include:
- Smartphones, tablets, and computers
- Smart TVs, streaming boxes, and digital picture frames
- Home routers, cameras, and other Internet of Things (IoT) devices
- Cloud servers and web servers with weak security
Criminals use botnets because they provide scale and disguise. Traffic from thousands of ordinary homes looks more believable than traffic from a handful of data centers.
What does "botnet hack" mean?
People use the phrase in several ways, and the right response depends on which one applies to you:
| What you mean | What it describes | Where to look |
|---|---|---|
| "My device was hacked and became part of a botnet" | A phone, TV box, router, or computer was infected and is being used by someone else | Device signs and cleanup (sections below) |
| "My website or server is being hit by a botnet" | Automated traffic flooding, scraping, login attacks, or fake sign-ups | Site owner protections |
| "My ad campaign is being hit by bots" | Fake impressions, clicks, or installs from infected devices | Advertiser investigation |
How do botnets commit ad fraud?
Ad fraud is one of the ways botnet operators make money, because advertisers pay real money for impressions, clicks, and installs. The main patterns, described conceptually, are:
- Hidden or invisible ad loads. Infected devices load pages or apps in the background, with no visible screen, so ads "run" and publishers get paid even though no person sees them.
- Fake clicks and searches. Bots click ads or run searches on sites designed to show and monetize ads.
- Fake app activity and installs. Devices simulate installs, sessions, or in-app events to claim rewards or attribution.
- Impersonation of real users. Bots mimic real device types and behavior so their traffic is harder to filter.
- Residential proxy resale. Infected devices are used as relay points so other criminals can route their traffic through ordinary homes, which is also used for fraud, account takeover, and scraping.
For the victim whose device is infected, there may be few obvious symptoms beyond slower performance and higher network use. For the advertiser, the result is wasted budget and polluted data.
A documented botnet case: BADBOX 2.0
In July 2025, Google announced legal action against BADBOX 2.0 and said it had compromised more than 10 million uncertified devices running Android open-source software. Google described pre-installed malware used for large-scale ad fraud and other crimes. The device count is Google's reported estimate for that investigation, not a prevalence estimate for all Android hardware. Read Google's announcement.
What are the signs that your device is part of a botnet?
No single sign proves infection, but several together should prompt action.
On phones, tablets, TV boxes, and other connected devices:
- You bought an off-brand device with unknown firmware. Very cheap streaming boxes, tablets, projectors, and picture frames from unfamiliar brands are higher risk, especially if they are not certified by the platform's security program.
- Apps you did not install, or pre-installed apps you cannot remove.
- The device asks you to turn off built-in security protection or to install apps from outside the official store.
- Unusual data use or constant network activity when you are not using the device.
- Slow performance, overheating, or fast battery drain while idle.
- Pop-ups, ads, or browser redirects that appear outside of any app you opened.
- Settings change by themselves, such as default apps, home screens, or permissions.
- Your router or network monitor shows connections to unfamiliar servers from that device.
- Accounts see strange logins or activity.
On computers and servers:
- Unknown processes using CPU, memory, or network
- Outbound connections to unfamiliar addresses, or unusually high outgoing traffic
- Spam being sent from your email or server
- Your server's IP address appearing on blocklists
- Security software alerts that keep returning after cleanup
What should you do if you think a device is infected?
- Disconnect it from the network (Wi-Fi and Ethernet) to stop it from communicating.
- Do not enter passwords on that device. Change important passwords from a clean device, starting with email, banking, and cloud accounts, and turn on multi-factor authentication.
- Scan it with reputable security software, where available, and remove unknown apps and extensions.
- Update the operating system and apps, if the device is from a reputable maker and still supported.
- Factory reset if appropriate, then reinstall only trusted apps from the official store. A reset helps with many infections, but it may not help if the malware is built into the firmware.
- Replace the device if it is an unbranded or uncertified product with suspected built-in malware, or if the maker no longer provides updates. Do not keep using it on your main network.
- Check your router and other devices. Change the router's admin password, update its firmware, and check for devices you do not recognize.
- Report it. In the United States, you can report to the FBI's Internet Crime Complaint Center (IC3). Elsewhere, use your national cybercrime or consumer protection agency. Also report malicious listings to the retailer.
For a work device or server, notify your IT or security team immediately and follow your incident response process.
How can advertisers tell if botnet traffic is hitting their campaigns?
Botnet traffic is designed to blend in, so look for patterns across several signals instead of one number.
| What you see | Why it matters |
|---|---|
| Large volume of impressions or clicks from a small set of apps, sites, or device models | Concentration may point to a single fraud source |
| Unusual or off-brand device models, or device and operating system combinations that do not match | Common in compromised consumer devices |
| Impressions with very low viewability, or no measurable viewing | May indicate hidden ad loads |
| Mostly residential IP traffic with many requests per address, or traffic from a proxy network | Can indicate relay through infected devices |
| High click or install counts with no sessions, engagement, or conversions | Clicks without people |
| Traffic outside your target market or at odd hours | Not matching real customer behavior |
| Sudden volume spikes in connected TV or app placements | May be a new fraudulent source |
| Cheap cost per thousand impressions with poor results | Low price can be a warning, not a bargain |
Seller or app information that does not match ads.txt, app-ads.txt, or sellers.json | Possible spoofing or unauthorized selling |
| Placements in unfamiliar apps with similar names to well-known ones | App spoofing or "evil twin" apps |
How do you investigate?
- Segment the data. Break results down by app or site, device model, operating system and version, IP type where available, country, hour, and campaign.
- Compare ad data with analytics. Check clicks against sessions, engaged sessions, and conversions by source.
- Ask your platform or DSP for log-level or placement-level reports, and request details on suspicious sources.
- Check seller authorization. Review
ads.txt,app-ads.txt,sellers.json, and the supply chain object for the sources involved. - Use independent verification for viewability and invalid traffic, instead of relying on one platform's reporting.
- Pause or exclude the suspicious sources, and use allowlists for important spend.
- Keep evidence. Save screenshots, reports, dates, and examples of the traffic, and submit a credit or make-good request to your platform and partners where your contract allows.
- Monitor after the fix. Fraud sources often reappear under new names, apps, or domains.
How can you protect yourself from botnets?
For device owners
- Buy from reputable brands and sellers, and prefer devices certified by the platform's security program. Be cautious with extremely cheap, unbranded streaming boxes, tablets, and picture frames.
- Keep devices updated, and retire products that no longer receive updates.
- Install apps only from official stores, and avoid "free" apps that promise paid content.
- Do not turn off built-in security protection.
- Change default passwords on routers, cameras, and IoT devices, and use strong, unique passwords with a password manager.
- Update your router, disable remote administration you do not need, and keep smart devices on a separate guest or IoT network.
- Use multi-factor authentication on important accounts.
- Check your devices occasionally, including installed apps, permissions, and data usage.
For website and server owners
- Patch quickly. Keep your content management system, plugins, server software, and dependencies up to date.
- Harden logins. Use strong passwords, multi-factor authentication, login rate limits, and lockouts.
- Use a web application firewall and bot management to detect automated traffic by behavior, not just by IP address, because botnets rotate through many addresses.
- Add rate limiting and challenges on sign-ups, logins, forms, and search.
- Monitor logs and traffic. Alert on unusual spikes, repeated requests, and odd user agents.
- Limit exposed services, close unneeded ports, and restrict admin access.
- Back up regularly and test your recovery plan.
For advertisers and publishers
- Buy from authorized sellers and check
ads.txt,app-ads.txt, andsellers.json. - Prefer curated and direct paths for important campaigns, and use allowlists.
- Be careful with cheap connected TV and app inventory that you cannot verify.
- Use pre-bid and post-bid verification from an independent provider.
- Review placement and device reports weekly.
- Track outcomes, not only reach: engagement, conversions, and revenue per source.
- Ask partners about their invalid traffic policies and credits.
- Use click fraud protection to analyze click-level data and block repeat sources.
Common mistakes
- Assuming a factory reset always removes a botnet infection.
- Continuing to use a device that shipped with built-in malware.
- Buying unbranded connected devices only because they are cheap.
- Judging campaigns by impressions and clicks without checking engagement.
- Blocking only data center IPs, while botnet traffic comes from home connections.
- Trusting a single vendor's fraud report without checking your own data.
- Never reviewing placements and device models.
- Ignoring unusual traffic because it improves your headline numbers.
Botnet response checklist
If you own the device:
- Disconnect the device from the network
- Change important passwords from a clean device and turn on multi-factor authentication
- Scan, remove unknown apps, and update
- Reset, or replace the device if the firmware is untrusted or no longer supported
- Secure the router and check other devices
- Report to the appropriate authority and the retailer
If you buy ads:
- Segment traffic by source, device, geography, and time
- Compare clicks and impressions with sessions, engagement, and conversions
- Verify sellers with
ads.txt,app-ads.txt,sellers.json - Pause and exclude suspicious sources, use allowlists
- Save evidence and request credits
- Add independent verification and click fraud protection
- Monitor weekly for new sources
FAQ
What is a botnet in simple terms?
A botnet is a group of infected internet-connected devices that a criminal can control remotely, usually without the owners knowing.
What does "botnet hack" mean?
It usually means either that a device was compromised and added to a botnet, or that an attack (such as fake traffic, spam, or a flood of requests) is being carried out using a botnet.
How do botnets cause ad fraud?
They generate fake ad views, clicks, searches, and app activity, sometimes by loading ads invisibly in the background, so criminals earn money from advertisers. Some botnets also rent out infected devices as proxies.
How do I know if my phone or TV is part of a botnet?
Signs include unknown or unremovable apps, unexplained data use and network activity, slow or hot performance when idle, ads or redirects outside apps, and settings that change by themselves. Cheap, unbranded devices with questionable firmware are a higher risk.
Can a factory reset remove a botnet infection?
It can remove many infections, but not malware built into the device's firmware. In that case, replace the device instead of continuing to use it.
What is BADBOX 2.0?
It is a botnet of compromised Android Open Source Project devices, such as off-brand connected TV boxes and tablets, that Google described in a July 2025 lawsuit as having affected more than 10 million devices and as being used for ad fraud and proxy services.
How can I tell if botnet traffic is hitting my ads?
Look for high volumes of clicks or impressions with no engagement, concentrated sources, unusual device models, residential IPs with many requests, odd geographies and hours, and very cheap inventory that does not convert.
Do residential IPs mean the traffic is real?
Not necessarily. Botnets and proxy networks use ordinary home connections so fraudulent traffic looks real. Use behavior, device, and conversion data, not IP type alone.
Can ad blockers or antivirus stop botnets?
They help reduce risk, but they are not a complete defense. Keep devices updated, avoid untrusted hardware and apps, and use layered protection.
Who should I report a botnet infection to?
Report to your national cybercrime authority (in the United States, the FBI's IC3), the retailer or platform where you bought the device, and your IT or security team if it is a work system. Advertisers should report invalid traffic to their ad platform and partners.
Can click fraud protection stop botnet traffic?
It can reduce exposure by analyzing click-level patterns and blocking repeat sources. No tool catches everything, so combine it with verified sellers, allowlists, and your own review of outcomes.
Next Steps
Botnets turn ordinary devices into tools for fraud, and ad fraud is one of their most profitable uses. For device owners, the best defenses are reputable hardware, updates, official app stores, and replacing devices that arrive infected or stop receiving updates. For advertisers, the best defenses are verified sellers, allowlists, independent verification, and a habit of judging traffic by what people actually do after the click.
Botnets can produce sophisticated invalid traffic. If your own site is affected, our website bot attack guide explains where to investigate and apply controls.
Investigate Your Paid-Click Quality
JuicyTraffic helps advertisers investigate landing-page click quality by campaign, source and placement using a tracking link and an on-site probe. Compare its per-click evidence with ad-platform reports and business outcomes. It does not replace malware protection, a website firewall, impression verification or an A/B testing platform.
References
Related Articles
- SIVT (Sophisticated Invalid Traffic): What It Is, How It Differs From GIVT, and How to Spot It in Your Own Data
- Bot Attacks on Websites: Signs, Risks and Prevention (2026 Guide)
- HUMAN Security Review 2026: Ad Fraud Protection, Bots and Pricing
About the Author
Dylan Dan is the founder of JuicyTraffic. He has spent 15 years specializing in adult advertising and ad-fraud prevention, helping advertisers assess traffic quality, identify invalid clicks and protect media budgets across dedicated ad networks.