Definition
A botnet is a network of internet-connected devices — computers, phones, routers, IoT hardware — that have been compromised by malware and can be controlled remotely by an operator without their owners' knowledge. Botnets are a general cybercrime tool used for spam, denial-of-service attacks and credential theft, and in the advertising context they are a major source of ad fraud: the compromised devices are directed to load pages, view ads, click, install apps and even mimic post-install behaviour, generating traffic that looks like it comes from thousands of real users on residential connections.
Botnet traffic is dangerous to advertisers precisely because it originates from real consumer devices on real ISP IP addresses, which defeats the simplest fraud filters that block data-centre ranges. The devices have plausible fingerprints, varied locations and organic-looking usage patterns, so distinguishing botnet activity from genuine users requires behavioural analysis over time rather than a single signal.
In context
For iGaming affiliate programmes, botnet-driven traffic can produce fake clicks, fake registrations and, in advanced operations, fake deposits funded through stolen payment instruments, so anti-fraud teams look for the tells that distinguish a botnet cohort: unnaturally uniform behaviour across supposedly independent users, activity concentrated in patterns that match a command schedule rather than human daily rhythms, device or browser attributes that recur across the cohort, and downstream metrics — retention, second deposits, genuine gameplay — that are near zero despite healthy top-of-funnel numbers.
Operating a botnet, or knowingly buying traffic from one, is a criminal offence in most jurisdictions and a clear breach of every advertising platform's and affiliate network's terms. It is defined here as a reference term because the concept appears constantly in ad-fraud and traffic-quality discussions; the practical takeaway for a legitimate affiliate or advertiser is that any traffic source promising large volumes of "residential" or "real user" traffic at implausibly low prices should be scrutinised for exactly these signals before any budget is committed.
Worked example
An anti-fraud review of a suspiciously cheap "residential" traffic package finds that 8,000 supposedly distinct users share only 40 unique browser-font fingerprints, all become active within the same three-minute window each hour, and none makes a second visit. The pattern matches botnet command scheduling, and the advertiser rejects the source and reports it to the network.
Related terms
Frequently asked questions
Browse the full iGaming & affiliate glossary — hundreds of EN/RU terms with examples.
← Back to glossary