To create a botnet. the attacker can use several techniques to scan vulnerable machines. The attacker first collects Information about a large number of vulnerable machines to create a list. Subsequen

In hit-list scanning, the attacker first gathers a pre-built list of vulnerable machines before any infection begins, then after compromising the first machine, splits the list so that newly infected hosts each receive half and continue scanning in parallel. This divide-and-conquer distribution causes exponential spread and drastically reduces the time needed to propagate malicious code across all targets on the list.

Topological scanning uses information already present on the infected host - such as local routing tables or email contact lists - to discover new targets, rather than relying on a pre-built external list.

Subnet scanning restricts the infected machine's probing activity to IP addresses within its own local subnet, not a centrally compiled list divided among bots.

Permutation scanning coordinates bots using a shared pseudorandom permutation of the IP address space to avoid duplicate scanning efforts, which is a different coordination mechanism from the pre-built hit-list approach described.