This paper presents a detailed case study of the botnet. The botnet consisted of over 100,000 machines and ex- hibited some novel characteristics while also taking advantage of some characteristics of existing, well-known botnets. One of the most novel characteristics of the clickbot is that it was built to conduct a low-noise click fraud attack against syndicated search engines. This paper focuses on describing the novel aspects of the botnet, and describes parts of our experience in in- vestigating it. For instance, we describe how syndicated search engines work, and how attacked such search en- gines. We believe that it is important to disclose the details of how such botnets.
