How do you know it's a botnet? For all we know the attackers have list of compromised servers that they use. I know the distinction is thin, but it still exists.