Invalid traffic & fraud
Botnet
A botnet is a network of computers, phones or smart devices infected with malware and remotely controlled by criminals, often used to generate fake ad impressions and clicks from real consumer devices.
A botnet is a crowd of hijacked machines taking orders from one operator. The owners usually have no idea; their laptop, phone, router or cheap streaming box quietly runs hidden tasks in the background.
For ad fraud, botnets are valuable because the traffic comes from real homes, real IP addresses and real devices, so it sails past simple data center traffic filters. Malware may open invisible browser windows, load ad-heavy pages, click ads or hijack an app's ad calls. The 3ve operation, disrupted in 2018 by the FBI and industry partners, used infected computers in this way; separately, the US Department of Justice described the 911 S5 botnet it dismantled in 2024 as having used some 19 million IP addresses as proxies. HUMAN's research on BADBOX 2.0 in 2025 described off-brand Android TV boxes shipped with ad-fraud malware preinstalled.
Because individual devices look legitimate, detection relies on SIVT techniques: spotting coordinated behaviour across many devices, hidden rendering, impossible activity at odd hours and infection signatures. Botnet traffic is classified as SIVT under the MRC IVT guidelines ("hijacked devices" and adware).
Think of it like this
A botnet is like someone secretly copying thousands of house keys and using the houses at night to host fake parties, so the neighbourhood looks lively while the owners sleep.
An example
A detection vendor notices 150,000 home PCs in Germany, Mexico and Indonesia all loading the same 40 obscure recipe sites in hidden windows between 1 and 4 a.m. local time, a hallmark of malware-driven browsing.
Related terms
Bot traffic
Bot traffic is visits, ad impressions or clicks generated by automated software rather than people, ranging from honest search crawlers to fraudulent bots built to look human.
Residential proxy
A residential proxy routes internet traffic through real home or mobile IP addresses, making automated or fraudulent traffic look as if it comes from ordinary households instead of servers.
SIVT (sophisticated invalid traffic)
SIVT (sophisticated invalid traffic) is invalid traffic designed to look human or legitimate, which can only be found through advanced analytics, multi-point corroboration and often human review.
Malvertising
Malvertising is using online ads to spread malware, scams or forced redirects, by sneaking harmful code or deceptive landing pages into ad creatives served through legitimate ad networks.
Device farm
A device farm is a physical collection of real phones or TVs, often racked on walls and controlled by scripts or workers, used to generate fake installs, ad views and engagement.
Sources: MRC Invalid Traffic Detection and Filtration Guidelines Addendum (2020 update), TAG: fighting malware