The first data set of an attack was sent to us by
the independent journalist Brian Krebs, who is specializing
in investigative reports of cybercrime activities
all over the world. The webserver hosting his blog
krebsonsecurity.com (KOS) was attacked in late
November 2011 by a DirtJumper botnet. The webserver
logs show 21,293 unique IP addresses participating in the
attack. Table 6 depicts the top ten countries the bot’s IP
addresses were mapped to.