A botnet is probably coming from hundreds, if not thousands of IPs, sprinkled in with normal user requests and often with similar frequency.