I suppose I wasn't very clear then. Ah well, life. > I'm more curious why we don't start large-scale investigations in response to each DDoS attack: each one g

I suppose I wasn't very clear then. Ah well, life. > I'm more curious why we don't start large-scale investigations in response to each DDoS attack: each one gives you a list of machines likely participating in a botnet. https://securityledger.com/2013/04/cyberbunker-owner-arrested-in-spain-rolled-in-mobile-ddos-van/ https://securityledger.com/2013/04/cyberbunker-owner-arreste... They do. It just has to be large enough.