A botnet solves a spammer’s infrastructure problem by making somebody else own the infrastructure.
Instead of sending millions of messages from one clearly identifiable server, an operator controls a large population of infected computers and distributes work across them.
Microsoft’s 2020 disruption of the Necurs botnet shows the scale this can reach. Microsoft reported that Necurs had infected more than nine million computers worldwide and had been used to distribute spam, malware, scams, and other attacks. The disruption required legal and technical coordination across 35 countries. See Microsoft’s account of the Necurs botnet disruption.
Nine million infected machines are not nine million willing senders.
They are nine million pieces of stolen capacity.
Distribution changes the economics
A single sending server has obvious limits.
It has one provider, a finite amount of bandwidth, a visible IP reputation, and a clear choke point. If it starts producing abusive mail, a provider can suspend it and filters can learn the source.
A botnet spreads that burden across many devices and networks.
The machine owner may pay for the electricity and Internet connection. The ISP handles the traffic. Mail providers process and reject the messages. Security companies track the infrastructure. Recipients spend attention sorting what escaped the filters.
The operator externalizes much of the cost.
That is one reason botnets became such powerful infrastructure for Spam Empires.
Taking down a sender is not the same as taking down the system
If one campaign domain disappears but the underlying botnet survives, the delivery network can be reused.
It may send a different advertisement tomorrow, deliver malware next week, or be rented into another criminal operation. Conversely, disrupting a botnet does not eliminate unsolicited email as a business model; another delivery mechanism can replace it.
This is the industrial distinction that matters.
The visible email is a product.
The botnet is a factory floor made out of stolen computers.