Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesBotnet activity in 2021 was visible through several distinct lenses, but the available reports do not establish one global botnet count. NICTER documented dark-net observations, Cloudflare reported attacks detected and mitigated on its own network, and the U.S. Department of Justice described an investigation into Emotet infections. Each shows a different part of the picture.
What the 2021 reports can—and cannot—tell us
A botnet is a collection of compromised devices that can be directed to carry out activity such as sending traffic or installing malware. But a report of botnet activity is not automatically a count of every infected device, every active bot, or every botnet worldwide. The three sources below used different methods and counted different things.
| Source | What it measured or described | Time boundary | How to read it |
|---|---|---|---|
| NICT / NICTER | Dark-net observations and subjects including Mirai-infected host trends, Sysrv-hello activity, and DRDoS observations | January 1–December 31, 2021 | An observation system’s view, not a census of botnets |
| Cloudflare | DDoS activity detected and mitigated across Cloudflare’s network | 2021 activity discussed in its Q4 2021 report | Provider-specific telemetry, not a global attack total |
| U.S. Department of Justice | IP addresses associated with computers that appeared infected with Emotet | April 1, 2020–January 17, 2021 | An investigation’s identified addresses, not a count of unique active bots for all of 2021 |
These boundaries matter: dark-net sensor observations, network-provider telemetry, and IP addresses identified during an investigation cannot be added together or treated as comparable measures of one worldwide population.
What NICTER observed across the calendar year
Japan’s National Institute of Information and Communications Technology (NICT) published its NICTER Observation Report 2021, covering the full calendar year. The report’s listed topics show the range of activity its observation program examined:
#1 Best Overall
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Dark-net statistics, including packet counts and destination-port distribution.
- Trends in hosts infected with Mirai and domestic infections involving Buffalo products.
- Sysrv-hello activity and traffic targeting Xiongmai video recorders.
- Growth in hosts sending GRE packets and observations of DRDoS activity.
This breadth makes NICTER useful for understanding several kinds of signals seen by an observation system. It does not establish how many bots were active globally, nor does the list of report topics by itself show that each trend represented a unique population of devices.
What Cloudflare’s DDoS report adds
Cloudflare’s Q4 2021 report describes attacks observed and mitigated on the company’s own network. It reports that the Meris botnet emerged in mid-2021 and continued to generate large HTTP attacks. The report also describes a November network-layer DDoS attack that peaked just below 2 Tbps and was launched by approximately 15,000 bots running a Mirai variant on IoT devices and unpatched GitLab instances. These are Cloudflare’s observations, not global totals.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Application-layer and network-layer attacks are different
An HTTP attack targets the application layer: the service that processes user requests. A network-layer attack instead tries to overwhelm network infrastructure or internet links. The distinction helps explain why a single measure of attack size cannot describe every attack’s effects. A service can be strained by requests at the application layer, while a network-layer flood can put pressure on the paths and capacity needed to reach it.
Cloudflare describes its own detection and mitigation process, including how it handles potential source-IP spoofing when presenting network-layer geography. Its figures should therefore be read as a view of the activity its systems detected and mitigated, under the report’s stated methodology—not as a complete map of all DDoS activity in 2021.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
What the Emotet disruption tells us about infection counts
In a January 28, 2021 announcement, the U.S. Department of Justice said investigators identified IP addresses for approximately 1.6 million computers that appeared infected with Emotet during April 1, 2020 through January 17, 2021. The number describes the scope identified in that investigation. It is not a verified count of unique active bots throughout calendar year 2021: an IP address is not necessarily a one-to-one identifier for a device, and the measured period began before 2021.
The intervention, conducted with international partners and involving access to overseas infrastructure, was designed to sever Emotet operators’ communication with infected computers and prevent installation of additional malware. The DOJ explicitly noted that the action did not remove other malware already present on affected computers. Disrupting a botnet’s ability to communicate is therefore not the same as confirming that every device is clean.
Rank #4
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Why broad cybercrime totals are not botnet statistics
The FBI’s 2022 summary of the 2021 Internet Crime Complaint Center report recorded 847,376 complaints of suspected internet crime and more than $6.9 billion in reported losses. These are broad IC3 complaint and loss figures, not amounts or incidents attributed specifically to botnets. The FBI identified phishing, non-payment or non-delivery, and personal-data breaches as the leading reported crime categories, underscoring why broad cybercrime totals should not be used as a proxy for botnet impact.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret a botnet statistic
Before comparing numbers from reports, check what each figure actually represents:
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
- Observation method: Is the number based on dark-net sensors, a provider’s network telemetry, or addresses identified in an investigation?
- Denominator: Does it count attacks, packets, IP addresses, apparently infected computers, or bots involved in one incident?
- Time window and geography: Is it a calendar-year observation, a quarterly trend, or an operation covering a particular infection period? Does the source describe worldwide activity or only its own field of view?
- Threat and attack layer: Is the botnet being discussed in connection with DDoS, malware installation, or another function? For DDoS, is the target the application service or the network infrastructure?
- Detection versus remediation: Does the report say a device was observed or identified, or that it was cleaned? A disruption to command-and-control does not itself establish that other malware on a device was removed.
For organizations, managed DDoS mitigation is one defensive category to consider when service availability is a concern. Cloudflare’s report illustrates one provider’s detection and mitigation activity; it is not an independent comparison of providers or a purchasing recommendation. The right safeguards depend on an organization’s services, exposure, and operational needs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
