Botnet size numbers are mostly wrong — here's what you can actually measure

Every few months a headline announces a botnet of “millions of infected devices.” Those numbers are almost never measurements. Understanding why teaches you more about threat intelligence than most courses — because the same honesty problem runs through the whole industry.

Where botnet numbers actually come from

To count infected devices you would need visibility into the infections themselves. Nobody outside the operator has that. What publishers actually have is one of these:

• Sinkhole counts — researchers seize a control domain and count devices that phone home. Honest but partial, and inflated by the same device reconnecting on new IP addresses (one laptop on mobile data can look like dozens of “bots” a day).
• Unique IPs over time — the classic inflation machine. IP addresses rotate, so a 30-day unique-IP count can overstate device counts several-fold. Reported as “devices” anyway.
• The operator’s own advertising — criminals marketing their botnet on forums. Quoted in headlines with a straight face.
• Someone else’s old estimate, recycled until it becomes “widely reported.”

None of this is lying, exactly. It’s measurement uncertainty laundered into confident headlines — and attack-surface math means the error is always in the exciting direction.

What you can measure: the C2 estate

What’s honestly observable from the outside is the command-and-control infrastructure — the servers the infected devices report to. C2 servers are findable (abuse trackers, scanning, threat feeds), countable, and their appearance and disappearance can be watched daily.

That’s why our own botnet tracking reports C2 estates, never infected-host counts — the number is smaller and less dramatic, but it’s real, and the trend is genuinely informative:

• A growing C2 estate means the operator is investing — new campaigns coming.
• Sudden estate collapse means a takedown, a rebuild, or infrastructure migration.
• C2 co-hosting patterns (multiple families on the same hosting) expose shared infrastructure and bulletproof hosts worth blocking wholesale.
• Persistence — how long individual C2s survive — tells you how aggressively the operator is being chased.

A defender gets more from “this family’s C2 estate doubled this month and migrated to two new hosting providers” than from any fictional million-device figure, because every part of that sentence is actionable: the hosts can be blocked and the trend can be tracked.

The transferable lesson: interrogate the unit

The botnet problem is a special case of the most useful question in threat intelligence: “what is the unit of this number, and who counted it?”

• “Ransomware attacks doubled” — attacks, claims, or leak-site posts? Counted by whom, with what visibility?
• “X million credentials leaked” — unique credentials, or rows in a combo file full of duplicates from older dumps?
• “This CVE is being mass-exploited” — observed where? One honeypot or a thousand?

Threat intel vendors have the same incentive as headline writers: bigger numbers, more fear, more budget. The antidote isn’t cynicism — real threats are real — it’s insisting on the unit and the counting method. Any source that won’t tell you both is marketing.

Go deeper

Our botnet layer tracks C2 estates per family with daily trends — the count semantics stated in the data itself, because honesty strings belong in the payload, not the footnotes. Start at Ninja Labz and the morning movements in Probably Fine Daily. Related: the vulnerability alphabet and how ransomware gangs pick victims.