Underworld uses its world wide IRC services in order to report infected clients attempting to connect to those public networks. With the help of the networks themselves Underworld collects thousands of compromised machines a day and report to security vendors, internet providers, hosting providers and national computer emergency response teams.

The data is collected thru a large set of automated processes looking for signs of an infected client.

All the data is used by The Shadowserver Foundation which has a international network warning internet providers.