Botnet

When malware infects an ordinary person's device, the attacker can add it to a "net" of thousands or millions of machines and give them all instructions at once. Used for ad fraud, the infected devices quietly load pages and click ads in the background.

Botnets are dangerous for search feeds because the traffic comes from real homes, real internet providers and real browsers with real histories. To a simple filter it looks like a normal household. Google lists botnets among its named types of invalid activity and says it has dedicated teams that hunt them.

From the arbitrageur's seat, botnet traffic usually arrives indirectly, through a cheap source that resells it. The signals are subtle: activity while the device owner is plainly asleep, many "users" behaving in near-identical ways, and a complete absence of advertiser conversions.

No single arbitrageur can dismantle a botnet. The realistic defences are to avoid unvetted sources, watch conversion quality per source and use IVT detection that recognises known infected devices and behavioural patterns. The legal and financial exposure falls on whoever passed the clicks into the feed.

Think of it like this

Imagine a burglar who secretly copies the keys to thousands of homes and uses each family's phone at night to ring a premium-rate number he owns.