This could indicate that the bulk of the botnet IPs belonged to some type of web browsing devices (e.g., home computers) that were compromised through an application layer attack, such as a malicious browser ad-on.