[brazzy]

As others have pointed out, the location of the IP address does not necessarily correspond with the location of the attackers.

Specifically, in Germany, the central-ish culster of dots is in the Frankfurt area, which is also the location of DE-CIX, one of the world's largest internet exchange points, and of roughtly 1/3 of all datacenters in Germany.

So I think rather than comparing the IP locations with population density, it would be even more interesting to compare them with the location of internet infrastructure. This is of course correlated, and probably harder to find as an open dataset.