Malware
Botnet
Botnet is a group of hijacked computers, servers, or devices that an attacker controls remotely and rents out for attacks, spam, and credential stuffing. The owners of the machines usually do not know.
How it is measured
You cannot count a botnet from your side. You see its members: IP addresses hitting your login page, spam submissions from varied residential ranges, or a flood from thousands of sources with the same odd user agent. Researchers estimate size by sinkholing the controller domain and counting distinct check-ins.
On your own infrastructure, a bot shows up as a process or script talking to a controller. Outbound connections to a single strange host on a fixed interval from several of your servers suggest they belong to the same herd.
Worked example
A forum owner sees 14,000 failed logins in one night across 3,800 distinct IPs, each trying only two or three passwords. Rate limiting by IP does nothing because no address repeats enough to trip it. Most addresses are home routers and a few cheap VPS boxes.
The attack stops when the owner enables a challenge on the login form and a per-account lockout. The botnet keeps running, simply aimed at somebody else.
How it differs
A botnet is the army. C2 is how it gets orders. A DDoS is one job the army can be hired to do. Many botnets never DDoS anyone and just send spam or probe for logins, so a botnet and a DDoS are not the same thing, and a worm is the self-spreading code that often recruits new members.
Common errors
Blocking one IP and expecting the attack to end. Assuming traffic from residential addresses is human. Counting devices rather than check-ins when you quote a size. Forgetting that your own neglected server or camera can be a member. Reporting an attack as one actor when the sources are just rented bots.
In practice
Defend at the account and action level, not the IP level. Add rate limits per username, lock accounts after repeated failures, and require a challenge on forms that cost you money to process. Patch and password-rotate anything you run that is exposed to the internet, since your own box can be recruited.